https://help.ubuntu.com/community/Gufw

https://help.ubuntu.com/community/UFW

Put simply. Just turning it on with incoming Deny as default will close the doors, as long as you don't run any outbound daemons (services), such as a web/ftp server. Then you need Deny outbound and add secific rules. Caveat: I'm not a security expert and this is a 'loose', simplified method.

Used in conjunction with sensible browsing, you should be fine.