Yes the problem with using technology as a sanction is that it can turn into a game - options include hiding all the ethernet cables, or leave just one out but slice into the wire, only damaging it enough to make an intermittent fault.
Or if you could lock the port speed to 10Mbit/s half duplex (laptop or router) that would slow things down on the wired side. A mismatch is even more unpleasant.
You could turn off DHCP and manually set IPs on the devices to have access - then he would have to learn about how IP addressing works.
On the router you may have some kind of "Disconnect" option to close the session (the PPPoA connection between you and the ISP) while remaining synced to the exchange (the exchange does not regard this as a fault).
I haven't found the manual for this model, just a few screenshots so you would need to have a nose around the various menus to see what can be changed.
If you are saying he bought the laptop with his own money and you don't feel comfortable confiscating it, perhaps you could misplace
the laptop mains adapter or accidentally
take it to work with you - rationing rather than a ban.
Most of these options require additional work for you so you are being punished too. At 16+ he can probably walk into any shop and pick up a PAYG internet dongle no questions asked, or figure out how to use a mobile as an internet connection for the laptop, so an internet ban will only get you so far.
Also if he is only just learning what an Ethernet port does that is another problem of schools that teach Office but not what the connections on the back of a computer do.
prompt $P - Invalid drive specification - Abort, Retry, Fail? $G
prlzx on n e w n e t: ADSL2+ / 21CN at 2.5Mbps / 800k