You can block internet access for all programs sandboxed except for Firefox, (of course you could replace firefox with whatever the name of your browsers executable is e.g Opera.exe, Iexplore.exe, etc..)
If you decide to add the above lines don't forget to hit the "Reload Configuration" button.
Then you may want to try some of the leaktests from a sandboxed browser at the link below.
Anything in the sandbox only, except your chosen browser of course.
I ran those tests and with the extra ini lines and SB seemed to block all of them but a couple did launch IE but it couldn't connect as I have FF as default.
Rule/s seem to be extremely tight even for just simple lines. If you're not (insert process here), you're not allowed to do this even you're (insert high ranking person or supernatural being)!!!
Sandboxie will just about stop any and all inet borne malware from infecting your computer.
It won't stop them being downloaded to your system but evereything is contained in the sandbox whereas a simple "delete contents of sandbox" will put you back to where you started.
Takes a bit of user input to save files from within the sandbox but once you learn the ins and outs of SB it sorta becomes second nature.