Using system policies to block downloadi

I have been trying to figure out how to use system policies to restrict users from downloading and installing files from the web. Can this be done or is the only way to do it, is to lock everything down except the apps that the users are allowed to run? Is there a better way to do this instead of using system policies? Any help would be appreciated.

Severini