A possible solution: - Block all machines from accessing the web, let them access only the intranet; - Install a lightweight VM with a browser on every machin

A possible solution: - Block all machines from accessing the web, let them access only the intranet; - Install a lightweight VM with a browser on every machine and use this to access the Internet (for e.g. you could use a VM with a small Linux distro only for browsing the net). The second solution is probably a good compromise. This will let you browse the Internet if necessary without compromising the physical machine security. It should be possible that on the same physical machine to allow external network access for a VM and block the other apps from accessing the Internet. You can probably do it from the firewall or use a separate IP for the VM and block all IPs from your router except the IPs of the VMs. The VM should be used only for browsing the internet.