Deny Internet Access

Try HTTP Filtering:
http://www.microsoft.com/technet/prodtechnol/isa/2004/plan/httpfiltering.mspx

first u must make rule to allow all.
1.Open Access Policy Then Right click on Protocol Rule / New Rule and Name it: Allow All, Next Rule Action: Allow, Next Protocols: Allow All IP Traffic, Next Schedule: Use this schedule Always, Next Client Type: Apply the rule to request from: any request, Next, Finish.
2.Open policy elements / and right click on
client address set /new set and add user name and ip.and repeat this to enter all users and then open allow all rule and applies to choose client address set below and choose the clients u want to access internet.