Internet access

Create an Organizational unit in AD users & computers. Or apply the following group policy to the OU that contains the users you would like to restrict. Right click the OU that contains the users. properties - group policy.
Create a new group policy. call it no internet access. navigate to user configration - windows settings - internet explorer maintenance - connection - proxy settings. Enable the policy and add a bogus proxy address.
Then navigate to user configuration - administrative templates - Internet explorer and enable the policy "disable changing proxy settings"
Now for all of the users that in a OU with the "no internet policy" , their browser will fail trying to use the bogus proxy, and the won't be able to change the proxyaddress to bypass the proxy policy

If you want to restrict by computer instead of by user, you can use a loopback policy instead. Again if you need more detail on that procedure post back.
- Good luck

A loopback policy will apply the group policy to the computer object rather than the user object in AD. You use it to apply a policy to a computer
instead of a user. For example if you had a computer say at a reception desk, and you didn't want anyreceptionists to use the receptionist desk for internet access. You however didn't want to restrict access on their user account because in the back office they require internet access to perform their job function, you could use the loopback policyto restrict just the front desk computer.