You could use the IP filters function in the router (Security > filter) to block those PCs.
Unfortunately, there's no way (that I can see, in the emulator
) to set a time range on it (if you could, then WU and definition updates could still run at night.) Therefore, you'd need to disable the filters nightly to allow updates.
My best suggestion is to either replace the router with one that has more configurability, or to replace the router with a Smoothwall. You'll have much more granular control over your LAN with it.
Another method would be to set a proxy address on those machines (in IE) of 127.0.0.1 (locahost), and then prevent access to IE settings via Group Policy.
Of course, this will also require that those machines normally run under a more-limited account (which they should be, anyways), that doesn't have access to GPEdit.
You also should read this Technet article
for a quick overview on IE and Group Policy.