SEP 12 - Restrict external web browsing if Win7 SP1 is not installed?

Hello all,

I'm trying to find a way to have SEP 12 block all external web browsing if the client OS is not up to Windows 7 w/SP1.

I've looked at ADC, NAC and various firewall options, but nothing is clicking for me.

I've thought of two options using NAC or the firewall:

1) Clear the proxy server on the client (NAC)

2) Block port 80, etc...(Firewall)

But don't know how to query the OS in a firewall rule.

Anyone have any suggestions on how any of this might be accomplished?

Thanks,

-Mike