A couple options off hand... At the pix you can block all http bound traffic that does not originate from the ISA server or ...
Use group policy to hard code the proxy settings in IE.

The pix is a better option and not as easily circumvented. Make sure you understand the repercussions of changes you make to the pix configuration.

I've never worked with ISA but it should be capable of blocking outgoing http traffic also, maybe setting configuring ISA to block http requests is a better option?