Setting up a WAN

I work at a company with over 500 PC’s all running win9X. The company is running frame relay to 14 locations. All frame legs are running T-1’s. I need all of my workstations locked from users loading software or playing games or browsing our openinternet. But the company doesn’t want to spend any money on software. All of our workstations have licenses and I have a server running win2000pro licensed. How do I setup each workstation and with what software to lock the workstation down and still be in complience with our current licensing? If this is not clear or you need more information, please e-mail me and I will give you the information to answer this question. Thank you for your help.