Short of installing a third-party proxy or NAT I think your only option is to use the Group Policy setting under User Config/Windows Settings/Internet Explorer Maint/Connection/Proxy Settings and set the proxy server address to a non-existant address for those "banned" users. Of course, once they figure out they can install Opera or Netscape you will be screwed on this one, but if your users aren't particulary creative this will work.