How can I disallow all network operations except for browser, mail? I am on a rather low monthly limit with my mobile phone plan. When travelling, I usually write mails and browse the web on my Macbook Air via iPhone Personal Hotspot.

However, I do know several system services send and receive data "in the background" when a network connection is available — but I don’t want my Mac to download hundreds of MB of system updates or similar through my costly mobile data plan. 

Is there a way to temporarily limit data throughput to a set of applications, let’s say Mail.app and Chrome.app? CLI solutions preferred, but any help is greatly appreciated!
You'll want a tool that lets you script the changes so you can roll them in and out or perhaps get fancy and script it based on the detected network connection interface.

I would start by evaluating Little Snitch to see if it fits your needs or at least can give you a leg up on the processes that are connecting in case you care to just control them. I wouldn't be surprised if Little Snitch were controllable from the command line - but haven't used it lately to know for sure.