Tomato makes this very easy. I've set up an "untrusted" network, devices in which can't connect anywhere, neither to local nor to remote machines (only I can connect to them).