How to prevent windows users to access web urls through any browser

Hi team,

We are using windows based app on AWS Windows EC2 instance. This application act as Desktop Streaming for any users. I would like to prevent users to access any web URL's from any browser except only one URL (*.xyz.com). This windows system should have access to *.xyz.com, but shouldn't do access any web URL's. I have tried with Proxy settings in regedit. But its blocking all web URL access. I hope we can't do with EC2 Security Group Outbound rule. Is there any possible way to restrict users to access any web URL's except one domain?