A simple guide to setting up a firewall on a Mac to block OffCampus connections from your preferred DC client, using Little Snitch. The client I've used in this example is Valknut - it should work for others as well. My version of little snitch is 2.1.4.
1. Open 'Little Snitch Configuration.app' - which should be in your /Applications/ folder.
2. Click the 'New' button to add a new rule.
3. Next to the application field, click the cog-like icon and select Choose Application from the drop down menu, then choose your DC application.
4. Fill in the fields as so:
5. Repeat this process for another two rules:
That should be it! When you open your DC client and connect to the HUB, you may get a notice from little snitch that your client is attempting to connect to xxx or xxx is attempting to connect to your client: you should select the 'deny until quit' option from little snitch. Such notices generally pop up when someone from off campus tries to download from you. Note that even if you're not around to press the deny button, the connection will still be blocked.
The above may interfere with the running of some DC clients, as they may try to connect to certain sites for their own reasons. I can confirm that it doesn't seem to break Valknut.