R7000 Access Control Feature

Can an owner of an R7000 confirm for me that the Access Control feature actually blocks access to the entire NETWORK, not just the internet?  I just returned an R6400 that would deny access to the internet, but still allow access to my network.  My old D-Link router would totally deny a connection unless the mac address was listed in my router table.  So before I try the R7000 I want to make sure it will block access similar to my old D-Link.