Background:
Our LEA runs an upstream proxy for my school and applies different content filtering rules based on the port used, thus 8081 is for primary schools, 8082 for secondary, 8083 for 6th form colleges and 8084 for "unrestricted" staff access.

The Bones:
We have ISA 2004 installed and tend to pass our students through it and on to 8083 at the LEA. I am however concerned about unrestricted staff internet access, particularly in the absence of any form of AUP. Thus the question is this - can I assign Staff to a group within ISA and then forward the staff group to 8084, whilst adding students to a Student group and forwarding them on to port 8083?

I have seen how to add mutliple upstream proxies to ISA but cannot seem to split traffic based on user groups. Any advice gratefully received.