Assign Web Filtering to DC/AD groups

We would like to restrict internet access for users, but instead of using IP/Mac address we would want to use the groups created on the DC (example: Sales/Purchasing/manager...etc)

How can we accomplish this ?

Also ..can we use anything else other than web filter to restrict internet access ?