Internet and Windows server 2003

Currently I have an AD, with DNS, DHCP, and NAT installed.
All of the windows xp home clients on the network (not logged into domain), have access to all internet facilities.
How do I stop computers which are not logged into the domain by some form or another from gaining access to NAT or Internet?