The short answer is YES an attacker can still pop a shell despite these conditions.
Using iptables you can deny all incoming but tcp 80 and 443 for http and https respectively. In addition you can deny all outgoing traffic (but you'd want to still allow for updates). But this can only do so much. You want to protect your web application and it would be more beneficial to use a Web Application Firewall (WAF) like mod_security.
In a web application platform you should be more worried about the owasp top 10 and web application exploits. A major concern is that an attacker exploits your system and then installs a backdoor like the C99 shell. In this case iptables doesn't mean anything, you have to allow http/https and that's all the attacker needs.
Blocking access with iptables does make the system more difficult to compromise with a buffer overflow. For instance download+exec shellocde is very common because it's a straightforward attack where the victim downloads and executes a backdoor. However the attacker doesn't need a connection to upload and execute a file. By using an egg-hunter as staging a buffer overflow exploit then the attacker can include a fair amount of complexity in the payload. For instance this would allow the attacker to load his executable in memory and then write it to a file.
The bottom line is Defense in Depth and security in layers. Use the most restrictive firewall rulesets you can.