Sorry but if you don't have a firewall there's no way you can easily enforce this using just a 3925 router.
If you control the user's desktops, you could possibly do a hack using your DNS server - e.g. redirect the DNS lookups for those sites to an Acceptable Use Policy page. If users can change their DNS though that wouldn't help too much.
If the enforcement of your pollicy is important to your organization, investment in the tools (license or product) to do so must be made.
We are pleased to announce availability of Beta software for 16.6.3. 16.6.3 will be the second rebuild on the 16.6 release train targeted towards Catalyst 9500/9400/9300/3850/3650 switching platforms. We are looking for early feedback from custome...