How to restrict one IP to only access one www site ... ?

Here is a weird one. I need to block one of our users from
getting Internet sites via their browser, but have to ability
to access 1 or 2 sites; both Internet connected.

The reason for this is that there is a web-based application
that these guys need to access, but they are not to browse ANY
other sites.

Is this possbile? Can I see an example maybe?

Thanks!

-- 
--
Peter Kelly
Network Administrator, O&Y Properties Inc.
Email: pkelly@ETS.net - pkelly@oypi.com - pw.kelly@utoronto.ca
PGP Public key: http://www.ets.net/pkelly/pgp.html
Key fingerprint: F3 FA 53 4E AC A9 DB 6F  0A C1 1B AB 40 49 74 15
--