User Configuration --> Administrative Templates --> System
Set the "Don't run specified windows applications" to
enabled and add "iexplore.exe" to the list. People won't
be able to run Internet Explorer. Probably a better way to
do it (Less tech support when user ring up to complain
that the net isn't working. I love the "This option has
been disbaled" window
) People will still have access
to the local network too.