It is fundamentally impossible to be sure that a powered computer can't transmit data. "Turning it off" isn't even guaranteed, since some computers have features that can run when main power is off. Even one with no network connection at all can potentially transmit via other means (e.g. via sounds or using the internal wires as radio antennas, among others), but in most cases this isn't a realistic threat (among other things, you'd need a specialized receiver in range to pick up the signal).
The simple (but not very reliable) approach is to use the Windows firewall to block outbound network traffic by default. This feature has been present in Windows for many years, but is rarely enabled because it causes most programs to either barrage the user with prompts or just not work. However, you can set exceptions to allow specific software that you trust to make outbound requests (and everything else can Just Deal With It). Note that this is by no means ironclad; there are many ways to get around such a barrier if the malware is aware of it. Some examples include launching an approved program in a way that exfiltrates data (e.g. opening your default web browser to a URL that contains the exfiltrated data as a query string parameter), using debugger or accessibility APIs to remote-control approved software and make it send the data, sending the data via something other than a conventional network (e.g. flashdrives, bluetooth, audio tones, etc.), or just changing the firewall setting / adding itself as an approved process (though that requires elevated privileges).
A somewhat more robust option is a proper air-gap, where the machine has no network or similar connectivity to outside devices, and ideally interacts with removable storage only in read-only mode (if at all). This will of course severely limit what you can do on that computer, but it will make it very unlikely to get malware and very difficult for malware to exfiltrate any data even if it does get on the machine somehow (not impossible though; see the various side channels mentioned above).
A seemingly-tempting middle ground might be a VM that is isolated from the host OS with no network device. However, this is less secure than it might seem if the host OS has network access, because the host can of course access anything in the VM disk image, or change the VM settings. Most malware won't even try, though, so if you want an option that is a little more convenient than the "firewall deny all" but about as robust, and doesn't require a second physical computer, this might be an option.
Note that none of these options or concerns are Windows-specific. MacOS does not (or did not, last I checked) support blocking outbound traffic by default, but there's third-party software that can enable this. You can also take the VM option with a Windows guest (secured) but a non-Windows (e.g. Linux) host, if you're specifically worried about Windows malware.
