New install...2 ISPs, 3 internal servers... have some questions

[Guest]

[limitlessent]

Ok...
My internal network is all 192.168.0.x
I have 2 ISPs.. 1 primary and 1 T1 as a failover.

I have 1 mailserver on 192.168.0.200
2 webservers - 192.168.0.201 and .202

Currently I am port forwarding 80/443 on 2 different public ips to the respective web servers and all the requires ports for the mail server on a 3rd public ip to the mailserver ip

I also have it set to that when the mailserver @ 192.168.0.200 connects out (to send mail) it connects out using the same static ip that port forwards to it to ensure it resolves correctly to other mail servers.  Same setup with each of the 2 webservers also.

Now..on to Endian...

How would I set it up to maintain that setup with it but also allow me to content filter user's web access on the same lan and controlling what users can go where while exempting the 3 servers?

What I'm wanting is to setup usernames/passwords for web access and certain usernames have full access while others can access a handful of sites and I need a few to have no internet access at all outside of webmail.

How would be the best way to do that?