It can be done using KiXtart--I'm doing exactly that at a public school. If your browser is Internet Explorer, you don't actually have to use a proxy server, but this method does require you to create a registry entry for a "phantom" proxy server:
code:
WriteValue("HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings","ProxyServer",
  "ftp=0.0.0.0:80;gopher=0.0.0.0:80;http=0.0.0.0:80;https=0.0.0.0:80","REG_SZ")
With this entry in place (which only has to be done once per user account), the following code can be used to turn access on and off:
code:
IF $internet="Y"
  WriteValue("HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings","ProxyEnable","0","REG_DWORD")
  WriteValue("HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel","Proxy","0","REG_DWORD")
ELSE
  WriteValue("HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings","ProxyEnable","1","REG_DWORD")
  WriteValue("HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel","Proxy","1","REG_DWORD")
ENDIF
You can set the value of $internet according to whatever criteria you wish, including group membership. You can also get fancier by turning on or off the IE icon on the desktop, and hiding or showing it in the start menu and quicklaunch bar.

One caveat: on your Windows 98 clients, the HKCU hive (where these entries need to be made) isn't loaded yet when the normal login script is processed. I handle that by including all the HKCU entries for Win9x clients in a second script (called logon9x.kix), and create a RunOnce entry invoking it in my primary login script:
code:
WriteValue("HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce","Logon9x",
  "kix32.exe \\servername\netlogon\LOGON9x","REG_SZ")
Hope this helps!

Joe