You could block destination ports 80 and 443 on your gateway for the client machines.
You probably dont want to block all machines, as you would need these ports also for server updates, etc.

And...