How do I disable Internet access on my MacBook as to make it as inconvenient as possible to re-enable it?
The most effective way to prevent a node (a workstation) from having Internet access is to stop it at the gateway.  

Why?  

Anything that you can do as an admin can be undone by another admin.  However, if you block Internet access at the network level, an admin of a single node (your MacBook for example) cannot bypass that restriction (unless of course you give them admin access to the gateway).

That said, a very effective way to block Internet access is to route Internet (default) traffic back to the localhost (127.0.0.1).  

$ sudo route delete default
$ sudo route add default 127.0.0.1


While not foolproof, it can deter a determined admin from figuring it out what's causing the block because the network appears to be operational as the internal network is still functional.  In other words, the user cannot browse the Internet, but still connect to local shares or use a network printer.

The caveat here is that to circumvent the block, you either reboot or just restart the network service.  However, you can have a LaunchDaemon that runs every minute ensuring this setting is persistent.

With this setup, the user is tricked into believing there's a problem with the network and not their machine.  Because even if they restart the network service, at most it will run for a minute, then stop.  If they were the present these symptoms to even the folks here on AD, the initial responses will be to look at the gatway.

It's not that you lock your door, it's the perception that your door is locked.