How to block SSMS from accessing the internet?
Instead of fully impersonating your privileged account, start SSMS with runas /netonly.  That will cause the SSMS Windows process to run as your logged-on account, and only use the privileged account credentials when accessing domain resources using NTLM authentication.
Http requests to internet resources will not use NTLM for resources outside of your trusted domain.
Alternatively you can configure the credentials in the Windows Credential Manager.
This is the same technique used to connect using Windows Integrated Authentication to a SQL Server from a machine not joined to a domain trusted by the SQL Server's domain.  See eg: https://www.mssqltips.com/sqlservertip/3250/connect-to-sql-servers-in-another-domain-using-windows-authentication/