How do block web surfing?

Depends on several factors.

What desktop OS is this?

What network OS?

Is there a proxy server on the network?

Desktop OS Winxp pro
Network OS windows 2003 server

If the security cameras have a static IP address, remove the DNS server address from the TCP/IP Properties. Make sure the login name is in the local user group 'Users', not Administrators or Power Users. This prevents them from changing the settings. Of course, keep the local Administrator password to yourself, and in the IT desktop documentation.

If you do not have DNS, you cannot surf very well. You cannot run automatic Microsoft updates either, but you if the PC is not exposed to the net, that does not matter so much. You need to have some way of delivering anti-virus updates to the desktop.

No proxy

As mentioned by Tiovo, you could remove DNS. You could set internal resources to then use IP instead of hostnames (or create a hosts file for internal resources).

Alternately, you could create a no access RAT file for IE (and ensure they are not able to install other browsers).

Here are instructions for the RAT file.
http://support.microsoft.com/kb/267930/en-us

Good luck!

Are the secutity cameras on your lan? If they are its not a problem there are several ways that you can go about doing this. You can block all access on your firewall from that computer outbound. But that may cause issues depending upon your updates if they are not distributed centrally you will run into trouble. Or maybe not knowing your firewall require users to logon to your firewall to gain access to whatever you allow. Another way if your using active directory is to point them to a bogus proxy server using group policy. User Configuration/Windows Settings/Internet Explorer Maintenance/Connection/Proxy Settions/ then set it for http,secure,ftp,gopher,socks should block everything and set it to do not user proxy server for local (intranet) addresses. Hope it helps just my 3 cents worth