Controlling internet access in a win2K e

I have a win2K Tree in which I’m connected to the internet via a DSL router using NAT. I wish to restrict certain users from internet access. Any ideas on how to do this without having a proxy server?

Thanks
Jeff