NAT Firewall: blocking certain computers from accessing the intern

Hello All,
I have a Win 2003 server machine that is my gateway (has 2 network cards:
INTERNAL and EXTERNAL) . The office network is connected to the internet
through this server (through NAT). I am trying to change the firewall rules
so that certain computers (with internal IPs) are blocked from using the
internet but I can't seem to do so. When I change the firewall rules on the
EXTERNAL to deny access to an internal IP, it does not work.
Any ideas ?