How to make secure FULL Internet access in the office?

Question

Computer networks

Hello, the organization uses the following scheme for accessing the Internet for any employee:

That is, so that the virus does not get on the PC, there is no Internet access on the PC, but the user can use the Internet on a laptop, which is also at hand
The size of the organization is getting larger, laptops are aging, often they break, and they're not cheap.
Is it advisable to do the following? :

That is, there is no Internet access on the PC, but if necessary, it launches a shortcut from RemoteApp on the server (there is nothing else on it), file transfer between the server and the PC, as well as the clipboard are blocked. On the firewall at the server, we leave only 80,443 ports, and others for normal operation.
Or is there something much easier?

Answer 1

Uncle Seryozh, well, it’s probably better to deprive everyone of the rights, and deploy a normal browser with group policy.
And if the data is critical (medicine, nuclear, banking), then let everyone through the cluster of their proxy servers mixed with antivirus.
Well, your idea is also, in principle, suitable, but then again, if it’s straight, what kind of data do you have there. The defense industry is no different.