I've been doing something similar for quite a while, by default blocking windows machines from having internet access, except for a tiny subset of programs. A dark island with a boat dock if you will.
Turns out its a real PITA with "modern software" much of which can't even install itself without internet access and programs that actually provide self contained installers becoming fewer and fewer.