Port blocking on client machines

Is it possible to block specific ports, in this case 80 and 443 for specific client machines. I am using windows server 2012 as a domain controller and have a group of clients that I want to be denied access to the inteet but to be allowed on local intranet. Using the server I want to set this up so the group have those ports blocked. Many thanks