If it were me, I'd simply ignore the whole Group Policy thing (since some users might be running Win98 which doesn't have that crap anyway), and just use Microsoft Proxy server for their internet connection. Then you can choose which users and groups get access from the proxy server's console.