Allow/Deny Internet access

I support/maintain an NT4 Domain for 1800 Students/Teachers/staff in a high school.Network also has Novell servers. Need an easy way to deny internet access on a user basis via logon script, reg setting, policy. I want to be able to deny internet access to students who abuse it by downloading junk, spreading viruses, unauthorized email, etc. All lab and classroom computers are connected to the School System network.
I have just setup an NT4 server and can use scripting tools to create individual student accounts based on registration database.
How can I control interrnet access? If logon is canceled, only network resources are disabled. The internet connection is still available.