How to cut off the user from the "outside world"?

Question

System administration

Good afternoon.
Such a situation:
1) There is a computer based on Windows 7, we have 3 users: Admin , User and Work .
2) The hard disk is divided into three local disks: the first is the system and programs, the second is games, photos, etc., the third is work and base.
3) The software package was installed by the Admin user (+ one valuable base on the third local disk, which must be replenished).
4) Policies "Disk Management" was set that the user User can see the system and the second disk (the third is prohibited), and the user Work sees only the third disk.
5) Parental control was allowed for the userUser to use all programs except workers, and the Work user has exactly the opposite.
Now to the question, all this was done so that under the Work user it would be possible to work with the database and working programs, BUT! It is also necessary to cut off the Work user from external drives, an optical disk and the Internet, so that the valuable database does not leak anywhere.
How to do it competently, so that when logging in under the User user there would be access to drives and the Internet (access to the database is already systemically limited), and everything was cut off under the Work user?
Available software solutions are welcome, but system ones are better of course.
Sincerely.

Answer 1

Windows has an awesome thing - politicians. for some reason, few people know about them, they use them even less, even less - they use them competently. in general, it is destroyed by politicians, write policies for different groups, shove users there, and there is beauty and order in the world.
there is no machine with Windows at hand, hallelujah, finally got rid of them, but in general gpedit.msc and google to help.