Seperation of Church (content) and State (intrawebs).

Hey all,

I've been pounding my head against this one for a while, mainly due to budgetary constraint, but I'm interested to hear what solutions people are using for the separation of content and internet.  

The usual logic prevails here, the easiest way to do this would be separate workstations, or perhaps kiosks (for actual work that requires the internet) and a separate wireless network and a BYOD policy.  Another way is serving up a secured browser through a remote server.  I'm interested to hear which method you use or what software is best for application virtualization.

I'm trying to find a application virtualization service that's well managed and not out of date, that works with Linux, OSX and LDAP, that also costs $0 or close to it.

Once you've stopped laughing at how crazy that sounds, please know I will be drowning myself in a sea of beer to stop the pain.