IP Restriction

I have many NT Wokstation working with IPX and IP on a Novell 4.12 network. The thing is I need to block some (IP) user from going out of the LAN to internet, but steel leaving the IP protocol for applications. I can configure the IP router in Win95to block them, but i don’t know how to do it in Win NT. I’m using a DHCP server witch i don’t have control to obtain the IP addresses.