Network Security…How much is too much?

As a Network Admin how much should we lock down a network, by what I mean is how little internet access should employees truely get?

Are we expected to moniter the network to see where workers are going or trying to go, or is that too extreeme?