Log into the user account you want to restrict.
Go to "Internet Options" and click on the "Connections" tab. Click on the "LAN Settings" button and put a tick in the box next to "use a proxy server for your LAN". Type into the "Address" box:
Click "OK" then "OK" again.
This will make the users account you need to restrict unable to access the internet.
You can use a Group Policy setting to remove the "connections" tab in "internet options" to prevent the settings being changed back.
Click "Start" > "Run" then type:
Click Computer Configuration > Administrative Templates > Windows Components > Internet Explorer > Internet Control Panel > Disable the Connections page, and click Enabled, click Apply then OK.
This is easily reversable.