Istio: does envoy capture *all* outbound traffic?

I’m starting to learn about Istio. So far I see it adds proxies to handle the various in/out connections, including common things like retries (I think), intercepting the pod’s advertised ports, etc. One question I’m having troubles finding the answer to definitively: does it capture all outbound traffic? Or only traffic destined for other services Istio is aware of (i.e. ones it has envoy proxies for)?

I’m trying to decide if I also need to set up ingress/egress rules if I want to prevent an untrusted pod from accessing services (either within the cluster, or elsewhere on the network).

Also, related to that, how does it handle differentiating connections to other Istio-proxied services vs non-Istio services?