If you can ensure that the x-box gets the same IP address each time doesn't the 2820 allow you to schedule time windows to firewall entries?

i.e just use the fire wall to block access "out of hours"

know-dice:
the Firewall will only block new connections, but, not, existing connections.

If someone is already using the the internet, the firewall will only slowly (if ever) terminate the internet-access.

This is common with all draytek routers I know, if someone has more detailed or other information please correct me.