How to prevent internet access to specific clients
You could possibly alter the DHCP reservation for the device(s) you wish to prevent internet access in such a way to make the DNS pointer point to something invalid, 127.0.0.1

Not sure if it's what you're after but it could be worth looking into. If I had OS X server myself, I'd write you up an applescript snippet to do the switching quickly and automagically.