Depending on the capability of your firewall, you may be able to do it
through it if it can manage outbound traffic and even the cheapest ones can
do that to some degree these days though you would have to configure rules
based on the IP address of the source computer and you may be able to have
different rules for different IP addresses if some computers need more
access. That would by far be the easiest way blocking all access other than
dns [port 53 UDP] and mail [ports 25 and 110 TCP].
Otherwise you can configure an ipsec filtering policy on each computer that
would act as a basic packet filtering firewall. With such a policy you could
start with a mirrored block all IP rule and then create a rule for the
exceptions. The exceptions would be permit mirrored entries in a filter list
that contain the local subnet, and other allow ports/protocols for outbound
access [such as I mentioned above]. Once you create an ipsec policy on one
computer you can export/import it into other computers. The link below
explains ipsec filtering policies more. --- Steve
http://www.securityfocus.com/infocus/1559