Have two network cards in the machine, one external facing for users and one internal facing for administration.

When you want to prevent access write a script to shutdown the client...