Lockdown IE to not allow URL change?

I have a situation where we would like to lockdown an on-site vendor to a
Terminal Server session to a web-based tool with a single URL. We do not
want them to be able to browse anywhere else. We plan to grant them a domain
user account in an isolated OU that only allows connection to our public
Terminal Server and use Group Policy to lock out their ability to network
browse, lock down their IE default home page to a specific website. Now all
we need to do is keep them from changing the URL (address) to browse to other
websites. There is no real Group Policy for IE to do that. Can anyone help?
—
Alan