Stop certain users accessing internet

Is there a way, perhaps using group policy, to stop access to the internet for a certain group of users. It needs to be accomplished on a by-user basis as some staff members log on to the same machines and require internet. We have a Windows 2003 native domain with two DCs, one running MDaemon for mail and the other mainly file and print sharing. The client machines are all XP Pro running Office 2000. We have a Sco Unix box running the inventory/sales software.