Single User Restriction from WWW in IIS4

I have been asked to restrict a single user from the WWW service in IIS4. The powers that be do not wish me to change to only NT Challenge / Response, and they do not want to make everyone have to logon when they go out onto the internet…
Has anyone got any ideas????