Instead of removing the internet connection (physically), you can:-
1. use a fixed IP address for the CNC PC without DEFAULT GATEWAY.
In that way you can still transfer files between PCs via the network.
2. Disable windows update by disabling the Windows update service and ALSO disable an entry in scheduled task put in by Microsoft to enable back windows update when you login.