Sure, setup a proxy server, then add the proxy server name to I.E. options using a logon scripts for those users that need access. You can also deny rights to the proxy server by users/groups. Or, setup a fake proxy server name for general users in the logon scripts, that way when they start I.E., they will hit a fake proxy server and not get anywhere. That way you won't actually need to setup a proxy server, but that is not the totlly correct way to do things.
You did not say what type of internet connection you have, but if it's a business, I'm going by the fact that you have a internet proxy server setup, or will to control access.