How do I remove internet access from a Google Instance?
What do I need to do to make that happen?
Apply firewall rules to it that restrict all traffic, inbound and outbound, except that which is explicitly required for you to gain access to the server.
The best way to dig yourself out is to not start up this server again at all, but rather take an image of its storage volume and mount it on a separate server. Then you can recover data without taking a risk that the malicious code will become active again.