For the Internet access you could create different group policies, for those you wish to deny internet access to, simply "Misconfigure" your proxy settings and apply it to the OU in which the users you wish to deny reside.
Then deny users rights to change the Lan Connections under IE
It's not the cleanest way, but if you already have AD, it's free :-D