Block internet for certain users?

Question

So I have a captive portal on one of my VLANs, works great. 
 I'm trying to find a way to block WAN access for some of the users on that VLAN, I still need them to login via the captive portal, but I'm hoping that I can restrict certain users to only local traffic (local resources on another VLAN) 
 
 Thanks. :-)

Michael Dunn · Accepted Answer

Create a higher-level rule: 
 From LAN (or whatever to identify the source) to WAN, Match known users, select the user. Set Action (just below name) to Drop. 
 Alternately if you just want to shut off web browsing it is a little better user experience doing this. This also still allows Windows Updates and a few other things: From LAN (or whatever to identify the source) to WAN, Match known users, select the user. Set Action to Allow. Set Web Policy to Deny All.