Internet Access Control in Windows Server 2003

Hi,

We have a number of groups, in two different cities, who need to access
specific external websites to do their jobs. Our Big Boss wants to move away
from our inefficient peer-to-peer network and put a Windows Server 2003
environment in place in stages, starting with the ability to limit employees
to only those sites that their specific function requires them to access.

Now as I see it, we need two servers, one in each city, to accomplish
this. In each city we need a Domain Controller, housing Active Directory,
and a member server to run ISA Server 2004 for the internet access control.
Is this right?

We have a number of other reasons for desiring a Win2K3 server
environment, but we want to put things in place one stage at a time as the
budget allows. if anyone can tell me what I need (minimum) to start at this
point, please let me know!

Thanks,
Jeff