I'm not a Cisco expert, but usually the configuration is flexible enough so that you could block common HTTP ports (80, 443, 808x, etc) by MAC or IP address if you like. That's not really a flexible method though.
What I would do is:
- Set up a proxy server somewhere (Squid, Nginx, ISA Server, etc).
- Enable proxy authentication and set up some ACLs based on user authentication and/or IP address. Test this to make sure it behaves as expected, depending on the username used.
- Once satisfied, apply a GPO that points your client computers at the proxy. Test that to be sure it really is blocking users.
- On the router, block outbound HTTP-related ports from your network, except from the proxy server.
Now you have fine-grained control on who is allowed access to HTTP, and you don't have to play with router config every time you add users, computers, etc. I suggest also that you always allow access to sites that provide automatic updates (like Windows Updates, updates from your AV vendor, etc).