Disable Internet for Client Use
You should use a proxy server ideally. Or set a local policy for the guest account giving them a specific IP address, then add that ip to the deny list on the router. You can also disable the network properties via local policy. Make sure the admin account has an allowed IP address on the router. Hey presto free work around