im pretty sure you can get webmarshall free for 30days, set it up on a box and target your problem child until your told to stop. and don't forget to get authorization before doing any sort of monitoring, this could back fire and make you lose your job...
webmarshall kinda sucks for a permenant solution, i used it before, but its the only one i can think of off the top of my head.
also make him a normal user while your doing this so he cannot modify browser proxy settings and bypass it...
g/l