Block Internet Access, Allow Intranet, No Proxy Server

Hello
Fix the GP so everyone have access and from your DHCP server publish only the subnet and DNS server. Do not publish the gateway

But wouldn't that then block Internet for every user?

For instance the GPO isn't applied to one OU, which contains managers, and they are allowed Internet access

If everything including the intranet web server is on the same subnet , and you don;t need to route any IP traffic to other sites, you could set all the client computers to have no default gateway ( or set it to an IP address that doesn't exist).  They would still be able to communicate on the local subnet but not beyond.

Then you don't need to set up any proxy server settings.

EDIT - re your comment above: if you want the managers to have different behaviour they would need to have either different IP configuration (such as pointing to a real default gateway) or different browser behaviour ( either them or the other staff pointing to a proxy server address).  Depending on how many managers there are, you may be able to set up fixed IP info for them, or maybe a DHCP scope with different options and with reserved IP addresses for these computers.  

Or the managers could run a script which adds (manually) an IP route to the internet, pointing at the default gateway.

In addition with my answer aflockhart's suggestion is correct

Further on that the best solution will be a UTM device but with a cost of course...

dstewartjr's suggestion is the way to do it.

This was exactly what I needed, and so simple!

Thanks very much