restrict users access to certain sites

we have about 1200 machines on our networks. we want to be able to revoke individuals rights to the internet. the problem is that they need access to certain sites to do their job. my supervisor would like to be able to grant them access to other sites as well when they are given permission to do so, preferrably with a password. i tried using a gpo to configure the content advisor to allow only them sites and it works great until ur logged in as a user that should have access and the content adviser is still on..