If it is possible to completely disconnect all browsing capability to the internet from within a domain, yet maintain a browser for access to an application, it would be a step forward for a project I'm working with.
If the lexplore.exe properties, (iexplore.exe is located in both Program Files and and Program Files (x86)) can be set to be banned from accessing any IP address other than the one associated with the application (https://myapp), it is a start.
Additionally, and probably not the right place for the question, it would be great to do the same for Google Chrome. There is information on how to disable guest use of Chrome, there doesn't appear to be much on how to disable it altogether.
REG ADD HKLM\SOFTWARE\Policies\Google\Chrome /v BrowserGuestModeEnabled /t REG_DWORD /d 0