IE Access control

Can anyone point me to a simple, inexpensive (but effective) way to control access to IE on individual 9x machines either by their domain (NT) logon or a separate password? We want some folks on the network to have Internet and others not. The source of access isn’t configurable in this way. Do you know a third-party product that will accomplish this?