Preventing internet access in WXP

Have a server with 3 workstations that talk to each other utilizing IP addresses. The server acts a domain controller.
How can I prevent users from accessing the Internet?
Is there a policy that can be used?