How to block ipfs

The title will probably trigger some people since the point of ipfs is to avoid blocking, but I have a legitimate need to block ipfs. My company is doing some research on ipfs and I don’t want any inadvertent node connections outside of our company network. I understand that I can simply change the bootstrap settings to remove the external locations, but I like to keep it easy for my developers. Blocking 4001/tcp and 4001/udp doesn’t seem to be doing the trick. Does anybody have any ideas so I can just let my developers go at it?

Thanks!

Checkout PNET: https://github.com/ipfs/go-ipfs/blob/master/docs/experimental-features.md#private-networks