put the users computers you dont want to have internet access into a new OU,
create a GPO that has proxy settings setup and just point their proxy
settings to 127.0.0.1. This should work for you.
User Configuration --> Administrative Templates --> System
Set the "Don't run specified windows applications" to
enabled and add "iexplore.exe" to the list. People won't
be able to run Internet Explorer. Probably a better way to
do it (Less tech support when user ring up to complain
that the net isn't working. I love the "This option has
been disbaled" window ) People will still have access
to the local network too.