Just put the device on a separate wifi without internet access, or look at the "child protection" features of your router. Ours can put devices based on their MAC into "access groups" which range from "full access" over "internet from <time> to <time>" to "no internet at all".