How to disable the Internet access for any or specific applications?

I am looking for a way to disable the Internet access in 2003 active directory for specific users, computer or a container with Group Policy or other way, but without any additional software. The users should be able to access domain wide resources but not the internet resources. Any software that installed on a PC includ but not limited to IE, Windows Explorer, Firefox, Opera, Yahoo, MSN, ICQ, and other messagers. Any sugesstions?