the easiest way to stop them is to either set a false public dns number in
the network settings or a false proxy setup in the internet options. Do this
to the computers you don't want accessing the internet at all. You can also
install different browsers uunnder dif ferent users that don't have the
false proxy setting and with some configuring, they should be able get
internet from those browsers.
Any one skilled in computers should be able to identify this and get aroun d
it easily so more importantly, if the users don't listen to the rules they
need to be punished or maybe even fired. This type of behavior might only
need to be done to one person before the rest get the picture.