I implemented this on a companies network in mid 2000's

all browser traffic went through extremely locked down secured proxy

all applications on the OS (bar browser) was routed to different set of proxies with only whitelisted IP addresses over VPNs/ leased lines/ MPLS

any data that tried to get out from a PC not in the above whitelist was flagged and investigated