How can I sandbox a macOS app to run specifically through a SOCKS proxy?

I'm in a situation in which I don't want to control the system proxy for this, but want to control it on a per-app basis. Say I launch Spotify, all processes Spotify spawns as well as the main Spotify process goes through my proxy, while the rest of the system maintains direct access. This isn't an issue for certain apps, that let you control proxy settings within them, but for most apps that isn't the case.