WireGuard VPN from Android, no internet, no Winbox

The usual advice is to leave "as is" the default OR build upon it.

The default is here:
Buying - RB1100AHx4 Dude Edition - Questions about Firewall - #4 by rextended

The possible debate only revolves around trusting the way the good Mikrotik guys drop things or being more explicit, see:
Review of PPPoE and Firewall rules for improvements - #9 by jaclaz
Ready to start my custom firewall rules journey