I'm not a network admin but I don't quite understand his logic... why can't you enforce group policy on a higher level (something like how OpenDNS can filter specific sets of sites)? Am I missing something?