Yes, an extended access-list would be the best way to do it. A couple of design suggestions:
1) To minimize impact on the performance of the router, do it all in one access-list. The performance hit you'd take killing outbound request packets isn't worth the price you'd pay in a second instance of access-list processing.
2) You don't care what the users ask for, you care what COMES IN. (Let some other network admin with a bigger router filter out what he doesn't want!)
3) DEBUG IP PACKET DETAIL is your friend in fine-tuning this access-list.
4) The "deny any any" (implicit deny) is already at the end of the access-list. Leaving it off shows that you're well-informed enough to know you don't need it.
A nice sample baseline of what you're looking for might be:
access-list 101 permit tcp any gt 1 any eq 80 <-- WWW
access-list 101 permit tcp any gt 1 any eq 21 <-- FTP
access-list 101 permit tcp any gt 1 any eq 25 <-- SMTP
access-list 101 permit tcp any gt 1 any eq 110 <-- POP3
access-list 101 permit udp any gt 1 any eq 53 <-- DNS replies
access-list 101 permit icmp any any eq echo-reply <-- Ping responses
access-list 101 permit icmp any any eq time-exceeded <-- Traceroute responses
interface WAN 0
ip address x.x.x.x y.y.y.y
ip access-group 101 in
Again, use DEBUG IP PACKET DETAIL to see what traffic you need is being "access denied" and change my sample as your needs dictate.
