I may have been a little misleading.
What I had in mind on my phone (GS4 running Android 4.3):
Settings / Connections / Data Usage
Scroll down to see usage for each application. If you see one using a lot of data that you want to turn off, tap on the app to get to an app-specific screen.. scroll down to the bottom and check "restrict background data". The description is "turn off background data on mobile data network only. Wifi will be used if available". My understanding is then that App won't use data in that case unless you specifically openf that App and place it in the foreground....in which case you usually want the app to be able to communicate (not always, there is the matter of ads). So it's not total control over data, but at least prevents apps from using data when you're not actively using the app. To get an idea of how much data you'd save with this feature: go to the same screen where you restrict background data and look at the breakdown of how much data the app has used in the foreground and the background. For apps that you typically associate with data usage (browser), the majority is foreground usage. For some other apps, the majority is background usage. My gmail used 1MB backgroundand only 245k foreground! My google voice used 203k background,vs 41k foreground. For Lookout security is is 618k background, 0 foreground. For websnap, 477k foreground, 27k background. For Google +, 242K background an 0 foreground (I don't even use Google+??!). There may be individual controls within each app to control this background behavior, but I think it's easier to manage them right from the settings page while you're looking at per-app historical usage. And it can be surprising to see how much data is used in the background by apps I'm not actively using.
I did use AFwall+ on my old Adnroid 2.3.6 phone (requires root). It's a good app.... very little overhead, gives more control beyond what you'd get from the Android background data settings...namely you can prevent apps from using data any time (background or running). AND you can also restrict even wifi access. If you have an App which has no user-useful reason to contact the internet but requests internet permissions for things like ads, it makes good sense to block off all avenues (data and wifi) for increased security. Ability to build multiple AFwall profiles and switch them with Tasker is a big plus for Tasker-ites. Reading the forums I remember there were some issues with AFwall and 4.0+, but they may have been resolved. I haven't kept up with it.