how to block ONLY web access

2 options:

1- Like others have suggested, use ACL's on the router(s) or firewall...

2- If you really want to only prevent him from using Internet Explorer, look into Group Policies (If I remember right, you can disable IE altogether, if not, you could do something like setting his proxy address to localhost (which will fail...).

Ammo

If the user does not have install rights, then just explicity deny access to iexplore.exe and whatever other browsers are on the machine.

-Maestr0