How to block internet (only) access on a Windows 10 computer, password-protected, while allowing local network traffic?

Hello, I'm working with an unusual client who needs the ability to lock down all browser/internet traffic so internet is not accessible, but use of local network (printers, file sharing) works just fine. This must be locked via password, so only a network administrator can change these settings.

My initial thought was to install a firewall like TinyWall where rules can be established and enforced with password protection. However, TinyWall can be uninstalled without the password and thereby defeat the firewall rules that disallow internet access. I could then perhaps use something like My Lockbox to password-protect access to the TinyWall folder on the machine (and hence uninstallation), but this is starting to get clunky.

Can anyone think of a more elegant solution that my kludge above? Thanks!