Internet email ability, but restrict int

setup: NT server, 17ws running 95/98.
problem: users need to access internet email, but boss wants to stop them from surfing internet. Other than using policy editor to modify the desktop and remove the IE icon, how can you allow access to internet email and not the internet? and, if I used policy editor, if an email has a hyperlink, they will be able to access the internet thru that and open a IE window. And if I use policy editor, do I only issue that on a workstation basis or do I have to install policy editor on the server and set up user policy from there?