The lazy way to firewall it without doing all that analysis would be to run it in Virtualbox with network access disabled. Do your networking on the host outside of the VM and exchange files between the host and the VM through a shared folder. If you need sharing between multiple windows machines, you can run Syncthing or similar on the hosts to synchronize the directories backing the shared folders across them. I run a setup like this at home for my other half, who needs to use windows for some things but balks at signing up for their cloud service.