As far as I know this cannot be done through GP. BUT you
could just disallow access to IE.exe in GP then they don't
have a browser. Or you could remove there address bar,
lock all there toolbars disable the run command, and some
other stuff but there are ways around that solution. The
only way to truly block internet access is to stop it at
the router.