By the way, the way that I disabled outgoing network was to disable Vnet and remote my router from the config. I was still able to access the server at its dedicated internal IP.
It also appears that if you disable remote access from the GUI it keeps the local IP - then your system can connect to the net for updates, but doesn't default to the Plex.tv remote passthrough.