To restrict all access, disable the network adapter.
(screenshots from Windows 7)
If you want to allow the LAN, but not the internet, go to the propertied, fill in the IP address and Mask, and remove the Gateway:
If you don't know what the IP address and Mask are, open up a command prompt ( WIN+R, then enter cmd), and type ipconfig
you will get something that looks like this:
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\windows\system32>ipconfig
Windows IP Configuration
Wireless LAN adapter Wireless Network Connection:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Ethernet adapter Local Area Connection:
Connection-specific DNS Suffix . :
Link-local IPv6 Address . . . . . : fc80::c007:ab08:643f:b7a%10
IPv4 Address. . . . . . . . . . . : 192.168.1.104
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.1.1