I have some observations I would like to share, I currently have 1 stock and 1 unbanned, has been disconnected since the start of all this but could very well be a banned box
I started testing on the stock xbox some of the suggested settings to maintain lan streaming but disabling live connectivity and here are some of the results
I first blocked live access and it indeed disallows connection to live BUT I went ahead and tried the live connection test and it went through with no issues at all, stated xbox live is up and running and passed the test so while this may block live connections, they may be able to ping you regardless of this one setting and certainly not a great solution as it is totally unknown what they can or can't do with this type of non access...
I then starting playing around with the network settings, putting in 2 fake dns entries did the trick, when i disabled the gateway ip though i seemed to have lost lan connectivity too
As someone above stated, settings on routers and xboxes can indeed be reset so I would think that as many failsafes you include the better
So, I plan on...
1)blocking xbox live in xbox 'console settings'
2)adding fake dns primary and secondary
3)block the mac address in my router settings
4)configure 'manual settings' to allow internal network but not external
5)keeping it plugged in all the time as streaming from the couch just isn't the same if i have to get up and plug in the cable! and umm, let the chips fall where they may!
These were tested on a stock 'live' machine to see what worked and didn't work, i certainly wouldn't try anything on your unbanned flashed xbox until you are certain you know what you are doing first

good luck
