Is the rule “red - deny - all” have a sense in NS?
If you don’t want any incoming or outgoing traffic: yes
Another option is to pull out the external network cable. IMO more secure than a firewall rule.
Probably then you should shredder your hdd?