Blocking all internet traffic from machine when using web filtering

I have a subnet (Green) that uses web filtering through SSO integration with a DC. I want to continue using web filtering but also block specific machines from any access to the internet regardless of what user is logged in.

My understanding of astaro is that traffic is first processed through web filtering and then the firewall rules. If web filtering allows the traffic, then it is passed regardless of the firewall rules.

For example, with user "testuser" on a machine with static ip 192.168.1.10, I create a web filtering profile of "allow all" and assign "testuser" to that profile. I can also create a firewall rule of "block all" and assign 192.168.1.10. If "testuser" logs in to 192.168.1.10, they are able to access the internet due to application of the "allow all" filtering profile regardless of the "block all" firewall rule to the machine.

I want to continue using web filtering but block a specific machine (in this example, 192.168.1.10) from any internet access regardless of the user logged into the machine. I can not list all users in a "block all" web filtering profile as those users will log into other machines on the same subnet (192.168.1.x). How would I go about doing that?

Thank you for any help