Question : blocking internet access for certain computers/users on a windows domain

I have a client who is very paranoid about the internet and email at her company.  As a result, she has until now used a standalone pc for internet and email use.  I am trying to convince her to run the dsl through the main router/switch so that others who do research can have internet and e-mail access from their desktops.

My question:  
--Can I completely block internet access  for certain computers and/or users with Windows Server 2003.  If so, how?
--If not, what 3rd party software or hardware will do the job.  I looked around and found a program called Browser Control which can run on Windows server 2003.  Wondering if this or something similar is sufficient.  
--Is it possible with higher end firewall routers to block internet access but maintain network access and file sharing?

Any detailed input on a solution that is secure, reliable, and easily managed would be much appreciated.

Answer : blocking internet access for certain computers/users on a windows domain

If you choose to do it Stuart's way, you need to configure Group Policy to prevent the users from changing the Network Properties of TCP/IP...  

Probably the best way would be to use a router/firewall that is managed, and has the ability to filter IP based on ACLs, but I am sure your user would not want to pay the price for such things as a Cisco Router or Pix Firewall...  So yes, you can institute a higher end device to do exactly what you wish here..  Be prepared for a small learning curve though..  :)

FE