There is no "best way". There's a myriad number of ways to accomplish this, one of which is through web filtering technologies provided by companies like M86.
Another way to accomplish this is to sign up for service with OpenDNS. They filter via DNS requests and do the blocking there.
Your firewall idea can be accomplished, but is generally not granular enough to filter properly. Also, as long as whatever you get is between the client computers and the internet, then you have effectively "rolled out" the solution to all client computers.