The easiest way is probably just not to have a default route. If you've set up a static IP address, edit /etc/network/interfaces and comment out the "gateway" line.
If you're using DHCP, you may be able to not ask for a gateway (edit /etc/dhcp3/dhclient.conf and change the "request" to not ask for "routers", but I haven't tested this. Alternatively, you could just delete it after...
Finally, you can use iptables for this:
iptables -P OUTPUT DROP
iptables -A OUTPUT -d 127.0.0.0/8 -j ACCEPT # let it talk to localhost
iptables -A OUTPUT -d 192.168.0.0/24 -j ACCEPT # use LAN range here
iptables -A OUTPUT -d 10.0.0.2 -j ACCEPT # your machine here
Keep in mind access to your DNS servers. If they're not on your LAN, name resolution will not work. (With the iptables approach, its trivial to add in rules to allow access to them).
Also, keep in mind you're disallowing access to (e.g.,) http.us.debian.org, so apt-get update/upgrade isn't going to work. You can fix this with iptables:
iptables -I OUTPUT -m owner --uid-owner 0 -j ACCEPT # allow root to do anything
assuming your services do not run as root.
Most services that auto-check for updates/report usage/etc. can be configured not to. You could also do that.
Also, if you want, you can use iptables to allow replies to incoming traffic from non-LAN machines (by using state tracking). Typing man iptables will give details.
