Need tool to block access to specific websites for only certain users on a terminal server

Title pretty much covers it. We have an RDS farm and users connect via RDP to the terminal servers, but we need to have the ability to block websites for only specific users on the terminal server. We've looked at SSO/FSSO with AD, but it blocks/allows with the IP address of the system, so if one user with allow access is on a specific terminal server, all users on that same server have allow access.

​

Does anything like this exist?