block internet only

Hi all
I have setup a cisco 871 router with a tunnel to my headoffice and I want that only headoffice tunnel should work. users should not be access to internet i.e. I want to restrict users to use only my private ip address range

Please help me