The way I implemented this in group policy was to disable the connections page
Computer Configuration/Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Disable the Connections page
Just to stop some of the users disabling the require proxy tick box
I then set the proxy to use an invalid IP address ie Internal network is 192.168.X.Y set it to 10.10.10.10 on port 1010
User Configuration/Windows Settings/Internet Explorer Maintenance/Connection-Proxy Settings
This will only stop the casual user from getting on the internet using Internet Explorer. If a user installs Firefox then they may still be able to surf the web.
The only other way I could recommend is to install a good firewall. I use a Linux based firewall
www.smoothwall.org at home. Then configure squid to require usernames and passwords to connect to the internet.