If you really want to make sure he doesn't connect to the Internet, or even other consoles, you could always yank the BCM4356 Wi-Fi + Bluetooth SoC out of the motherboard. I can't guarantee that the system will still work or even turn on, but then you won't have to worry anymore!!!
In all seriousness, if your child is old enough, you could explain to your son that "if you update or go online with the console, your games won't work anymore." That's the explanation that I used for the PS Vita and the ones that understood that statement/lie never did; the ones that did told me they never played online or updated, but I saw Wi-Fi connection settings set up.