Internet Access Control

We are currently deploying a new domain and network configuration. One of our challenges is finding an EASILY maintainable solution to controll internet access by user account. We are a manufacturer and do not give access to the internet to about 50% of our network I.D.’s. What solutions in this area have proven successful for others?