restrict internet access based on user

I'm running a network of about a 100 computers; a few rh machines, a lot of nt's and 2000's.

I'm using a rh9.0 box as my PDC. I'm trying to not allow a few users with roaming profiles to not access the internet. The users will be logging into the NT(sp 4) which as IE5.0 and the 2000's which only have mozilla.

If it helps I'm using a few Cisco Cat2950 switches.
To put another restriction, I can't upgrade the software.

I'm not sure what level to restrict them on. If it were all IE5.0 I might be able to use IEAK. Is there a Windows option for this? Cisco's software has something like this, but it completely blocks out the port if the user logs on(I think.) Or should I look at th e firewall?

Thanks

I would add a reservation for that users machine in DHCP, then restrict Internet access by that IP.