How can I lock down IE to only open one specific site when running as a Ctriix Published Application?

I'm running a Citrix 4.0 Presentation Server.  Some users have an icon for IE so that they can browse the internet.  Most users do not.  

We are now deploying a web based EMail client for everyone.  This means that users who are not allowed access to IE will need to run a browser.

I would like to configure the browser for certain groups of users so that it will only access our Webmail URL.  That's easy enough to do by running IE in kiosk mode.  The problem is if a user receives an EMail with a web link, they can simply click the link and launch a non-kiosk session of IE, then they can browse wherever they like.

Previously, we had used an ACL to restrict access to the Internet Explorer directory on the server which prevented them from launching IE.

I know one option is to setup a Group Policy that can set a bogus proxy for all other addresses, but I'm not sure how to implement that on a group by group basis; or if that's even the best way to solve the problem.

Thanks,

NathanStart Free Trial