Block outgoing connections for certaing uids (root, apache, nobody)
Try using the numeric UID instead of the name. For example:
-A OUTPUT -m owner --uid-owner 400 -j DROP
instead of
-A OUTPUT -m owner --uid-owner apache -j DROP
You can find the UID by typing
id user