You can find you answer by simply search on Google .But here is your answer :
You must create a rule above the rule that allow all user to access to the internet . first of all you must create a domain set that its contain the sites you want to allow access to them . for example for www.yahoo.com the domain name must be <b>*yahoo.com</b> .
This rule must be like this :
<b>allow</b> a\ action,
all inbound /outbound traffic,
source must be the computers or IPs that you want to restrict them .
destination must be the domain sets that you’ve already created.
and in final step choose it for all users .
apply the rule and test it.
if you have any question mail me :