Google app mail loads via
http://mail.google.com/a/[domain] and gmail loads via
How can I block computers on my LAN from accessing gmail urls but at the same time permit accessing google apps mail urls?
I can modify settings on the router (including changing it to dd-wrt if required), configure a server on the network (e.g. to add a squid proxy), and make local changes on individual computers (we have both Macs and PCs). However, any local changes that you suggest should be fairly difficult for a user to bypass or else the solution won't hold.