Restrict Internet Access by group

How can I restrict access to the internet for a specific group of users on a group of computers?

I work for a boys home and we have a training room that both staff and boys use. We are running Active Directory on W2k network and Windows XP on the computers in question. I want the boys to be able to log on and have access to network resources on these computers, but not get out to the internet. (We provide other computers where they can log onto and have access to the internet/email) I also want staff members to be able to log onto these computers and be able to access the internet.