Does Android KitKat and later have sufficient default sandboxing to
prevent malware from doing any harm
How long is a piece of string? Ensuring confidentiality isn't the only goal of information security, if the App was to run a background service that constantly consumed significant CPU with the goal of draining your battery would that be a threat?
Is it important to check the safety of an Android app that does not require root permissions and will not have data access?
Beyond the privileges afforded to Apps by default, what specific resources an App may or may not be a threat to depends largely on how the Android permissions system is applied. Bare in mind that the titles and descriptions of Android permissions do not always fully or unambiguously convey what access it grants.
For example, I think the current Play Store permissions dialogue displays something like "Uses one or more of: SMS, MMS. Charges may apply." for access to SMS, which does not necessarily give the impression that it can read SMS's.
Therefore even if you were to read and selectively apply every permission individually, you might still end up affording some access that you didn't anticipate.
Beyond that, Android Apps have access to a significant number of permissions by default or without explicit approval. For example I believe the Play Store does not currently display internet access on its permissions acceptance dialogue.
Both of these examples are specific to Apps installed via the Play Store, but I'm sure there's examples that don't depend on the Play Store. Also, even if you check the permissions after installing an App via the Play Store and revoke certain ones, there is still a window where the App could be a threat.
If data access is disabled for the app (via a firewall)
Finally, I wouldn't discount side channel attacks. A malicious App can use IPC to pass information to another App which then exposes it to the Internet. The simplest example would be the App constructing an Intent to open a URL in a browser, and that URL could of course contain sensitive information. Unfortunately the Android App selector dialogue (where you'd select your browser) does not show you the URL to check for sensitive information before it's opened. At that stage it might be too late.
TLDR; Android does have strong sand-boxing compared to a traditional desktop OS, but that isn't an excuse to be careless. You should still consider 3rd party software to be a threat and evaluate it accordingly, relying on the sand-box to be an extra layer of security in case your other controls fail.