How can I deny access to all webpages but one with Active Directory?

I need to limit my employees’ access to the internet to specific sites. I do not want employees to have full internet access, as I do not want the legal liabilities of their browsing.

I have a server in place with Active Directory installed, but I do not know how to use it to control web access.

I need to be able to deny all access, and then allow specific sites for specific users.

Say employee A needs access to site 1, and employee B needs access to site 2, and employee C needs access to both.

Is there a way to do this, or will I need 3rd party software? And if a 3rd party solution is the way to go, what would be recommended?