Restrict Internet Access for user but allow Administrator Logon Access

We are on a domain.
Windows XP.
Mainserver Windows Server 2000.
We use a third party for our Email and access it via MS Outlook but we need to have the Internet enabled via TCP/IP.

We have asked the users not to surf during office hours etc but if they abuse this trust we will have to restrict them and to remove the Internet from them, can we do this but still allow the Administrator logon to have internet access to do downloads and upgrades etc? If this is not available can we restrict the user and Administrator access?