deny enduser from IE

I have one domain and 35 users also using AD and I’m wanting to deny Internet access for some can someone help me remember were I need to an do this