Disable Internet Explorer Connections Except for 1 Web App

How can I allow a group of Windows XP users access to a single web application in Internet Explorer 7, but disallow access to all other websites? Can I do this on each client, or must it be done via the web server or through a group policy? If so, how?