Maintain 350 system without adding windows domain

Hi, this is pradeep.
I am working in medical billing coding office, here we have 350 System in workgroup, each users have the internet, users doing his job in internet only, but some of the user using the porn websites, so its attacks the whole workgroup computers, i am unable to block those site, because user have the administrator permission, how can i maintain 350 system in workgroup please advice me……