web activity blocking

I have a client whose office includes three computers on a small "Windows Workgroup" network. One is a Linux fileserver running Samba, and the other two are Windows XP Professional workstations. One of these XP machines sits on the client's desk, and the other is on his assistant's desk. He has enquired about a means of preventing access to any websites other than a specific business-related list of sites from his assistant's computer, but he still wants full access from his own machine. The Internet access is provided by cable broadband, and the network is serviced by a small off-the-shelf router/firewall that will allow blocking of predetermined URLs (a site-ban list), but will not allow across-the-board blocking with an exception list.

I'm more than willing to learn what I need to for configuring and installing a simple server that will provide the needed functionality, and the client is willing to pay for such a server's installation. Advice . . . ?