Remote terminal server: how to prevent RDP users from surfing the Internet from it?

Question

Squid

In a small organization, workplaces have clean computers with nothing but Windows and an RDP client, all work is done on the terminal server, which is out of harm's way.
The Terminal Server is deployed on a slightly modified Windows 7 Ultimate. User rights are limited from everything that they do not need to touch, each user rustles in his own small space, BUT:
Users sometimes have a tendency to rummage around the network, sit in contact, classmates and so on.
Task: to restrict access to some (namely, some, but not all) to any web, except for: a couple of sites with services that we use in our work.
I'm not strong in this area, but I found a Squid proxy.
Did I understand correctly that if you deploy this thing on a computer that acts as a terminal, then it will be possible to restrict the freedom of surfing for specific users, and not for everyone? And if there are articles with examples of the development of such an economy, I will be grateful.

Answer 1

Block all browsers except IE, and in it you allow access only to trusted sites ("white list"). Pick the server's security policies.