If the PC has a static IP address, you can use an access-list to deny all other traffic.
Yep, the IP of 192.168.3.5 won't change, and the user won't change it. I wish it was as simple as telling a child "you're being punished and therefore you can only see one web site" It's actually one of our production managers who only 'manages' to surf all day. There are two or three valid sites that he ought to be able to visit, and that's why I need to restrict everything else. I'll see what I can figure out from an access-list point of view.