best practise to securing internet access

hi all..

i was wondering what would be the best practices in securing or denying internet access in the server – client enviroment with windows 2000 server and XP on side. mean if have to give only access to certain sites and denying on others.

and also how to block certain ports on which messenger services run like. yahoo, msn, gTalk, AOL etc.