Deny internet access to port

Can someone please point me in the right direction to deny a specific port or MAC address to access outside of my network (the internet)?

I would still like to have access to that device from within my network. I guess you can say I would like to quarantine a specific device from accessing the internet. From other posts, would Interface Shaping Rate be the right solution? Or something else?