You can sonfigure Microsoft ISA. It will acte a a Fire Wall and /or Proxy. their you can choos the users that can brows or not.
also you can By GPO disable IE but any wyse user will have a portable FireFox on their USB key. So the best way is with a proky. their is ather proxy simple of use non microsoft.
Barracuda is on also net nay with is ContentWatch™ <a href=”http://www.contentwatch.com/”> is a good solution. sonic wall have a solution in their router also. those solution are for Small business. big enterprise use nortell, cisco, HP and other guys like that