Sorry I need to search for that, but
I've a new Idea in mind, if you could try it (but needs some experiance in asp.net)
1)as I said before you make an access rule in ISA for every one that deny access to those sites and make redirect to your asp.net application page
2) add an exception to that rule if user is for example "directshppoinguser@yourdomain.com" aftter adding that user to AD with limitted privalages
3)in your page before executing the redirect to original site imporsinate the working thread with this user
in this case even subsequent visits form the same IE sessions will not be intercepted