On the router
As roxan already wrote, this cannot be done on the Android device itself (well, at least not easily), but should take place at your router. Some routers allow to specify on a per-device basis whether internet access should be granted, using a single "switch" (yes/no).
If that's not possible, you'd need to edit firewall rules. This would require to assign a fixed IP to your device, so on your router you could specify e.g. (pseudo-code):
route from <android_ip> to <internal_network> pass
route from <android_ip> to * reject/drop
(again, that's pseudo-code; I'm not that familiar with
iptables to give the exact syntax by heart). What that then would do: All packages from your Android device would pass the router if targeted to the internal network, but would be rejected (visible to the Android device, so it could react immediately) or dropped (connections would timeout then) when targeted to the outside.
Basically, as Android uses
iptables as well, the same should be possible directly on the device, one might think. But I'm not sure whether that is really true: from the Android device's point of view, everything is targeted outside (to its gateway). Which gives another idea:
On the Android device
I've just checked on my device, and Android indeed includes the
route command (though I needed to run it via busybox, e.g.
busybox route to show configured routes). So let's assume your local network uses
192.168.0.*, and your router being
192.168.0.1, you could do the following:
# default gateway (should already be defined), but we don't want this
#route add default gw 192.168.0.1 wlan0
route del default gw wlan0
# re-add route for access to the local network
route add -net 192.168.0.0 netmask 255.255.255.0 192.168.0.1 wlan0
Now the device should no longer know what to do with packages e.g. for
22.214.171.124, and would return a "no route to host". The example already shows a problem involved:
126.96.36.199 is one of the pre-configured name servers. So make sure you configure your device to use a name server in your local network, if you want name resolution (well, Google's name server won't be of much use for your internal network either).
Not also that your interface used might not be called
wlan0. Find out by invoking
route without any arguments: this will list all established routes like this:
link-local * 255.255.0.0 U 1000 0 0 eth0
So in this case, I had to use
eth0 for the interface.
192.168.0.0 * 255.255.255.0 U 205 0 0 wlan0
This would describe our example, using
wlan0 as interface, and
192.168.0.* as network. As on my device this route already had been present in the routing table, it might even suffice to simply drop the default gateway.
I didn't run a test to verify everything is fully working according to your intention (though it should, I might have included some typo here or there). So I'd be glad to hear from you how well it did :)