preventing users access to internet

I want to prevent some users to access the internet. I have a SBS2008 server and the all the workstations in the domain are running WindowsXP.
Is there any Group Policy I can use or setting in the DHCP server (of the SBS2008 server)?