I tried in the VM during beta, windows firewall deny all policy blocked _all traffic_. Should be enough unless MS decided to lie about data statistics visible to the user, I didnt look at the network stats outside vm.