Assigning a range for proxying in a NAT server?

Okay, I have a very typical setup: in-house network, Linux-based
firewall running NAT to a single IP on the outside.

I want to set up Dan's Guardian for *some* of the address within the
household. For a certain range of IP addresses (basically, the kids'),
I want to be able to shutdown all outgoing ports except for a very few
(HTTP, POP3, IMAP), assign a proxy for the web browser on their
computer, and have all of their traffic filtered.

Is there a straightforward way of doing this?

Elf