Registry Key to deny internet access

Source

There are 2 easy ways to do this by GPO. The 1st is User Configuration > Windows Settings > Internet Explorer Maintenance > Connections > Proxy Settings. Check the Enable Proxy Settings box, for the proxy server address choose 10.0.0.1 Check Use same proxy server for all addresses and un-check Do Not Use Proxy Server for intranet addresses. I use this for several classes of users and it works well. The advantage of doing it in this manner is that in the event you need to add sites to allow these users to go to you can add them to the exception list.
The second way is do dis-allow iexplore.exe via GPO. That policy is located in User Configuration > Administrative Templates > System > Don't run specified Windows applications. Then you would enable that policy and add iexplore.exe.
There are also 3rd party applications like app-sense that you can use as well but I think the GPO method will work for you.

Charlie