How you'd like to accomplish this with only 100% standard Windows features?
Assuming your users already are logged on to their local PC, be it in an ADS domain or a non-ADS situation, they can launch ANY tool on that PC - including IE. (Unless you restrict access with local security etc., which is what you not want seeing your question.)
Restricting outside access with the browser has to happen at an intermediate layer. E.g. the proxy, in a setup where the browser can not get direct outside access (NAT etc.) and hence is forced to use this intermediate proxy layer.
And yes, the proxy can run ISA - but probably there are other, cheaper, options around which can still use ADS security.
So I'm afraid that you are forced to an ISA server-like model, at least...
HTH,
- The Netherlands