You can limit where people go with regex and class maps. I have a handful of users that are only allowed to go to certain sites, and here's what I did:

Create your acl:

access-list RESTRICTED permit ip host 192.168.1.5 any

Match that ACL:

class-map RESTRICTED

match access-list RESTRICTED

Create your regex:

regex espn "\.espn\.com"

Create your regex class-map:

class-map type regex match-any Internet_Allowed

match regex espn

Inspect the regex class map, but only allow what DOESN'T match:

class-map type inspect http match-all INTERNET_RESTRICTED

match not request header host regex class Internet_Allowed

Create a policy map to perform actions on above:

policy-map type inspect http RESTRICTED_INTERNET

class INTERNET_RESTRICTED

reset log

(The reset above will reset any connection that DOESN'T match your regex. It allows only espn.com.)

Then create a policy to apply to the inside interface:

policy-map INSIDE

class RESTRICTED

inspect http RESTRICTED_INTERNET

(The class above matches the acl for your hosts, and the it applies the other policy map RESTRICTED_INTERNET to scan against your acl.)

HTH,

John