You can prevent a user from accessing the Internet by forcing Internet Explorer to use a proxy server that is set to an invalid address.

NOTE: Any program that uses the ProxyEnable and ProxyServer settings at
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings will be prevented.

You should also set Connection Settings and Connwiz Admin Lock, both REG_DWORD data types, at
HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel, to 1 to prevent the user from changing these settings.

These setting must be set before the user logs on, but can be set in a logon script.

You can use REG.EXE, built into Windows XP, Windows Server 2003, and later, or installed on Windows 2000 from the Support Tools on the operating system CD-ROM:

reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /V ProxyEnable /T REG_DWORD /F /D 1                              reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /V ProxyServer /T REG_SZ /F /D ""                              reg add "HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel" /V "Connection Settings" /T REG_DWORD /F /D 1                              reg add "HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel" /V "Connwiz Admin Lock" /T REG_DWORD /F /D 1                              
or you can use regedit /s <Path>\filename.reg, where <Path>\filename.reg contains:
REGEDIT4                              \[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\]                              "ProxyEnable"=dword:00000001                              "ProxyServer"=""                              \[HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel\]                              "Connection Settings"=dword:00000001                              "Connwiz Admin Lock"=dword:00000001