You can configure Microsoft ISA. It will act as a Fire Wall and /or Proxy. Their you can choose the users that can brows or not.
Also you can by GPO disable IE but any wise user will have a portable FireFox on their USB key. So the best way is with a proxy. Their is a proxy simple of use non Microsoft.
Barracuda is on also net nay with is ContentWatch™ is a good solution. sonic wall have a solution in their router also. those solution are for Small business. big enterprise use Nortel, Cisco, HP and other guys like that