Hello @alefattorini and thank you for this reply!
I was hoping for a slick solution to easily add by IP Address each workstation that needs to be completely locked out from the Internet. Looking at ClearOS they have something called Access Control whereby they can set a schedule of when Internet Access is allowed almost like a parent/guardian feature to lock down the Internet for certain devices if needed. I suppose I could add a firewall rule for each Workstation but I was hoping there was a way within a module perhaps that would keep all these rules separate from all my other Firewall rules. I may at times need to open Internet Access to these workstations and having all these in one place or module would be cleaner than finding the right firewall rule.