Restrict Access to internet & maintain access to LAN

Greetings,

​In SEPM, I've been trying to create a policy to restrict our XP machines to our LAN only.

I figured it would work similarly to an ACL, so I've made a Firewall policy that is set so the first rule allows all access to our local LAN (Allow Local:Local Subnet) and the second rule denies all traffic, both are checked as enabled, as is the policy itself. I applied the policy to a test group, but any machines I place in the test group can still access exterior sites.

​I've pushed the Update Content action to these hosts as well as restarted them, still no dice. Any ideas of what I'm doing wrong or is this just not possible to do with SEP?

Thanks in advance.