Thank you terziyski for your reply.

I went to "Advanced/Security/Service Filtering", turned on "Service Filtering", Service Type = Any(All), Protocol =  TCP/UDP , from Port 1 - 65535, Filter Service for = Singe IP Address and added the PCs IP and rebooted the Router and PC. This might be OK to achieve what I was looking for…

However, there is another pretty simple solution. I’ve changed the network setting on that specific PC to a static IP address (e.g. 192.168.1.123), entered Subnet mask 255.255.255.0 but kept standard gateway blank. This will allow the PC to see the local network, but no internet. Simple but effective.

This is of cause nothing secure. Means a user could easily change the settings back to DNS client mode, but for me good enough to prevent accidentally internet access