Cannot prevent services from accessing network

I'm on a limited bandwidth wifi connection. Every day around 1PM Google Play Services gets online and uses 3Mb for about 10 minutes, which severely degrades the internet for all other clients.

I set up a task & profile to prevent Play (the app) from accessing the network during the day. That didn't work - looks like Play (the service) is the real culprit. But, there's no way (it seems) to prevent a service from accessing it.

So, then I set up a rule to deny all network access between certain hours (really it needs a location in the profile too, but I'll cover that once I get this working.) That worked to the point of suppressing the service - however, I'm on project Fi, which makes calls over Wifi.

So, I tried to whitelist (network: allow app) the Phone.extensions.GoogleDialtactsActivity (the only Phone app available) and Project Fi in the same task -- but I'm still unable to receive incoming calls.

Is there a different way to facilitate this, or is the core issue that I can't tune network access for services?

Thanks