User based Internet Access Restriction?

We have a NetWare 5 network and restrict Internet Access by users using BorderManager Access Control. This is done by creating Access Rules to allow/deny access to IP address’, host names, etc. These rules can then be assigned to users, groups, containers, etc. through NDS.
We plan on converting to a Windows 2000 Network in the near future, running IP, and using DHCP. Is there a solution for a Microsoft Network to control access through a server (acting as a router or gateway or performing NAT) by assigning ‘access rules’ to users and/or groups in Active Directory?