I think your only option is to use the Group Policy setting under User Config/Windows Settings/Internet Explorer Maint/Connection/Proxy Settings and set the proxy server address to a non-existant address for those "banned" users

Hmm I hadn't thought of that but I think I'll give this a try. Thanks for the tip! Our users are not terribly proficient.... so little worry about rogue Opera or Netscape installs. Some still have trouble using a mouse.