Give users a bogus proxy server and remove the ability to change it

Create a group policy called No Internet or something along those lines. Create a security group and put the users that are not going to use the internet in that group.
Edit the rights of the policy so authenticated users don't have a check in the box to apply the policy but add your new group to the policy and make them apply the policy. Next edit the policy:
User Configuration:
Policies-Windows Settings-IE Maint-Connection Proxy settings and give it a bogus IP address.
Admin Template-Windows Components-Internet Explorer-IE Control Panel and Disable Connections page.

This will prevent users from getting out on the internet and prevent them from turning off the proxy settings.