I think this can be done with Windows Firewall settings using netsh commands.
With the Windows firewall enabled, programs can access Internet only because they have exceptions installed. Windows makes your life easy by adding some exceptions. You can work on that.
On a Windows XP, I get something like the following (this is filtered output from Cygwin)
$ netsh firewall show allowedprogram
Allowed programs configuration for Standard profile:
Mode Name / Program
-------------------------------------------------------------------
Enable Google Talk / C:\Program Files\Google\Google Talk\googletalk.exe
Enable Microsoft Fax Console / C:\WINDOWS\system32\fxsclnt.exe
Enable vncviewer / C:\Program Files\TightVNC\vncviewer.exe
Enable Skype / C:\Program Files\Skype\Phone\Skype.exe
There are these two commands,
$ netsh firewall add /?
The following commands are available:
Commands in this context:
add allowedprogram - Adds firewall allowed program configuration.
add portopening - Adds firewall port configuration.
and,
$ netsh firewall delete /?
The following commands are available:
Commands in this context:
delete allowedprogram - Deletes firewall allowed program configuration.
delete portopening - Deletes firewall port configuration.
If you delete specific programs at some time,
they would be firewalled outbound access from your Internet connection.
You can then add them back in when you want.
This can be scripted (even in Windows).
If you are using another firewall, such configuration controls are expected on it too.
