Prevent DNS Forwarding for Some

[ShagDevil]

You can also lock down IE in every way imaginable via group policy - prevent them automaticaly entering a poxy configuration in the Internet settings

Nokia is absolutely correct on that one. You can lock down IE to the point where they can't even use it. The one easy thing to do is this (if you're just looking to lock down a few machines and not apply a network wide GPO)
-logon to the machine you want to lock down
-run gpedit.msc
-Go to Computer Configuration--> Administrative Templates--> Windows Components--> Internet Explorer--> Internet Control Panel
-Dont expand Internet Control Panel, just highlight it
-From here, you can disable *everything* from General to the Advanced tabs that most users have access to under Internet Options.

This may be one way from allowing these specific users to bypass anything. Just a thought. Good Luck.

**Just be aware that if you do have a network applied GPO, it will override the local GPO settings on the local machine. Working with GPO's can get messy, so take your time.