For your situation, I think the best solution would be to put a proxy and restrict those that do not need access to the internet.