Internet Access

In the school where I work the various computer suites are arranged into logical OU’s. I have been asked if its possible to deny internet access to individual suites on a per lesson basis (i.e. only deney access to maybe one suite and leave the others active).

My first thought was through group policy though at the moment I can’t seen to find a way. Is there a way through IPSEC? I’m sure I read something about this a while ago.