Lock out I-net

I’ve got a small (25 users) NT network, exchange mail services. I’ve been asked to eliminate internet access of several users, without blocking mail services. How is this accomplished at the machine level?