We use a login script to check the connecting computer name and if it doesn't match the list we deny the connection. We exclude some users from this check so they're always able to connect, whether in the office or not. So you simply add a line for each office computer (or authorized computer) and add a line for every user you want to exlude from the check. Below is a sample from the script:
IF %USERNAME% == joeschmoe GOTO OK
IF %USERNAME% == janedoe GOTO OK
IF %CLIENTNAME% == OfficeComputer1 GOTO OK
IF %CLIENTNAME% == OfficeComputer2 GOTO OK
IF %CLIENTNAME% == OfficeComputer3 GOTO OK
REM The following message is displayed on computers not authorized to connect.
msg * You are not authorized to login from this location. You will be logged off in 10 seconds.