How to restrict Internet, not just web, access for the guest account?
Please read this carefully and have another device with internet access, in case you are locking yourself out.

In OS X you will use the OpenBSD based tool pf which stands for "packet filter".


Helpful man pages are man pfctl and man pf.conf
You need sudo access.


Edit /etc/pf.conf to your desired needings:
An example pf.conf would be simple as this and look like this

## blocking rule
block out user guest


Now activate pfctl with sudo pfctl -e and load your config with
sudo pfctl -f /etc/pf.conf. 

For checking the syntax of the config file you can use pfctl -nf /etc/pf.conf.
If you want to deactivate the firewall, pass the command pfctl -d.

Testing the new configuration is as simple as curl -I apple.stackexchange.com. The firewall should block this for you.

However, I'd be careful with restrictions. If you are losing your Mac or it gets stolen, the guest account is the only account which one will be has access too(hopefully) which in return should have access to the internet to track it down(if "Find My Mac" is enabled).