Blocking Internet by Usergroup.

Here the story... two groups of users, one access the internet, the other not so much. Currently, I have the groups authenticating via FSAE and the connection between FSAE and my DC' s are working just perfect. Firstly, the Authentication redirect page does not work properly. Nothing redirects. Secondly, is there a better way to block all internet access than how I currently have it set up? For the group that will not be allowed to access the internet the corresponding firewall policy will only allow users to access DNS thus blocking any other protocol requests. The problem I have with this method is it doesn' t notify the users the sites are blocked, it simply wont load. I have tried setting up wildcards and regular expressions to block all websites in Web filter > Content Block but I do not believe I did it properly as all sites structured as www.something.com are blocked but mail.yahoo.com will get through. Any additional insight on this would be greatly appreciated!