Ok, you have a Airport Extreme that is connected to a Broadband Modem. You have 3 Macs with Airport and you want to restrict one of these Macs access to the Internet, but not the internal network.
The only solution that I can suggest is that you do this:
1. Create a new user account on the machine that you want to restrict. Give this User Account no Admin rights.
2. Then in the Sharing Control Panel, select the Firewall tab. Click New, Port Name: Other, Port Number: 80, Description: Web Access, select OK
3. Start the Firewall.
4. Logout. In theory, the User that uses that machine cannot use the internet now.
If this doesn't work, or it's not what you are looking for, you might want to look at your Airport Hub Admin Software more closely. In the Airport Admin Software suite, you can restrict machines via they Mac Address, and you can restrict them via IP numbers. You might want to explore your manual more closely.