Active Directory - Internet Access Control

Question

Hello everybody,

I have a windows 2000 active directory enviroment, usual configuration, nothing fancy. I have three types of users: those who can access any site, those who should not access any site, and those who have access only to a fews sites. All three kinds of users will use the same computer at different times, so I need to do the restriction on the user level not on the machine. ON the machine IE , firefox and Chrome are all installed, so IE specific solutions will not do the job. How can control the internet access level for each user as described above?

Thanks alot.