How can I reliably check in automatized way that there is no Internet access from the Windows (Server 2012 and later) instance? I mean all possible protocols and programs.
You still need internal network access, correct? There are lots of ways to be confident the system has no general Internet access but no way to PROVE it. (If it is networked it can be tunneled, etc.) You could programatically verify there is no default route for IPv4 or IPv6 - Only routes for your internal networks. It's basic but easy to script.
If the problem you are trying to solve is making sure the network firewall admins did not open up outbound Internet access from your DMZ, you will need to do active testing against an outside (AWS or other hosted machine) with a combo if scripted NMAP blasting out from the machine you are testing and a deny all firewall on the AWS/hosted sensor machine with logging. You will need to know what source IP the machine being tested is coming from. Since it should have no Internet access, you can't just script in a "canihazip" check.