Log into the user account you want to restrict.
Go to “Internet Options” and click on the “Connections” tab. Click on the “LAN Settings” button and put a tick in the box next to “use a proxy server for your LAN”. Type into the “Address” box:
127.0.0.1
Click “OK” then “OK” again.
This will make the users account you need to restrict unable to access the internet.

You can use a Group Policy setting to remove the “connections” tab in “internet options” to prevent the settings being changed back.
Click “Start” > “Run” then type:
gpedit.msc
Click Computer Configuration > Administrative Templates > Windows Components > Internet Explorer > Internet Control Panel > Disable the Connections page, and click Enabled, click Apply then OK.
This is easily reversable.
Test all apps to see if this applies the restrictions the way you want.
Let me know if this works alright for you.