The Thuraya SatSleeve-Hotspot is doing exactly what is needed. Wifi connection to your tablet and with an app, you enable to disable the connection. And if you don’t want to have spurious download, just use the way described in section 2 of this document (well for ipad!)
Terminating unused apps doesn’t prevent the device from going online and doing spurious transfers.
The ADL product doesn’t need firewalling or proxy servers because the Iridium connection is (AIUI) set up to not be an open internet connection. So any app trying to connect won’t see anything – except their own app which will go to their own server (which may be on a fixed IP, and being on a fixed IP is more efficient because there is no DNS involved).
I think the Satsleeve is just as vulnerable to this problem as anything else where an open internet connection is provided. The Satsleeve does the same thing as the Thuraya XT phone but instead of USB it provides a WIFI access point.
Interesting, thanks @Ultranomad !