Run everything inside a VM. Next level would be develop in live USB, qubes OS or bare metal for every project (screw general purpose computer)

At the router level you can block Tor, block VPS IP ranges etc. You can also block the entire internet and only allow ips from your browser history

Besides sandboxing you can run a firewall, I tested with some reverse shells and it does stop them. Of course a red team can do more bad stuff