You can find out when an application starts and stops, by listening to NameOwnerChanged signal on dbus, so it is really easy to use dbus-scripts to start a specific connection when an application starts, and disconnect from network when the application stops. Adding reference counting is less trivial, but not too hard.

For applications that keep running but need to connect only once in a while (such as mail) it is harder, probably needing some ip tricks - have a default route to some dummy interface when not connected, and initiate a real connection when something uses this interface, for example.