The best way to do what you are describing is the use of a web proxy and NAT. Any surfing is done by one single box. Meaning that the client PC never actually touches the outside world when surfing the web. Smoothwall is IMO a the best of the mentioned.
You always inspire me Swimmer! Now, off to make a mess of my "sudo" intranet lol