I believe you can use ipchains and set hosts deny all and then add specific hosts allow by ip or hostname, but I haven't done it yet. If I am wrong, hopefully someone will correct me :>
Also, our isp has a gateway that is filtered or an unfiltered one at no extra charge either way, if you are mainly trying to filter out objectional content (it sounds like you aren't, but want to limit to specific sites)
A way I have done something similar is to NAT the LAN and use the router software to deny specific sites, I think you may be able to only allow specific sites too (pretty sure, really) but haven't done it.
I'm hoping someone will help on this. I haven't actually done this before, but believe it can be done fairly easily at a routeror with Linux, and probably a host of other ways.
At least this post might get you noticed :>
Hope it helps.
If no one else posts, I'll ask some friends in the business.