Setting user access

How do I set up a user account that can access most programs but not the internet? The computer is a Dell running XP pro attached to a server running Winserrv 2003.