You might want to check out outgoing connections in Enterprise Edition with all the official Telemetry switches flipped to off, you will be surprised.

The only way is a total firewalling of all Windows services from the internet, including dnscache.