GROUP POLICY

I have been tring to restrict internet explorer from a user. I created and OU and Group Policy with this user in it. I search every option I could find to prevent them from having access .
The only way I could prevent access was to use both DC and workstation settings. Is not Active Directory able to do all this from the Server?