The problem then is that individual PCs need to be locked down to prevent users changing things or installing another browser oreven an alternative OS.

Maybe alternative methods could be considered such as permissions on the LAN or firewalls. The simplest method may be to remind users of office policies and that internet use is monitored and logged.

Where does that XP connect to retrieve that payroll information?

Within a Local Area Network (LAN) like a company intranet? That should be easy to lock down. Or doe it connect to an external website on the internet, like a payroll company?

it connects to the internet only. I didn't put it on my domain. the connection is to the ADP website.