Confine a device to the local network?

I want my NAS to be able to talk to other devices in the local network (as a NFS server) but not give access to the internet.

I have a double NAT, the NAS is in the inner network under a VPN and I want to keep it there (i.e. I don't want it to request the internet, or devices outside the innermost network).