How can I disallow all network operations except for browser, mail?

You'll want a tool that lets you script the changes so you can roll them in and out or perhaps get fancy and script it based on the detected network connection interface.

I would start by evaluating Little Snitch to see if it fits your needs or at least can give you a leg up on the processes that are connecting in case you care to just control them. I wouldn't be surprised if Little Snitch were controllable from the command line - but haven't used it lately to know for sure.

I settled for Little Snitch:

I created a "deny any connection" for any processes and added back the applications I want to be able to use the network.