Win 10 Pro -> Start -> Search -> "firewall" -> "allow an app through Windows Firewall" -> "Change settings" -> uncheck apps and features to disallow access to internet.

I turn nearly everything off. ... Check again and find various apps are allowed. (especially after a Windows Update, but seeming at random as well) WTF.

This is bad security.

In the past week the following apps became re-enabled in Windows Defender Firewall: "Xbox Game bar", "Windows Maps", "Windows Calculator", "Movies & TV", "MSN Weather", "Microsoft People", "Groove Music".