How to block Internet accesses ?

How can I block their Internet accesses other than receiving email and one specified application?
All clients on LAN are connected to the NET through a Leased line, our management don’t like their staff surf the Net in or out of working hours. But they have to communicate by email.
How to do this?