AFAIK, there's no easy way to deny ALL internet access.
If you're concerned about web browsing, you can deny read or execute permissions to this user on iexplore.exe. You can do the same for outlook.exe, etc.
But as for a blanket way to deny all internet access, it's really not something that can be easily configured at the client machine. Especially if you have a LAN and want access to the LAN but not the internet. This is something that's easier to configure at the router/firewall/proxy/whatever level.