A cheap D-Link DFL-700 can do that and still provide you with a real LAN and real DMZ network.
The DFL-700 can block all web access (or any other) and then permit you to white-list by domain name, IP, or even partial names like
*.microsoft.com/* and the white-list will override the black-list.It also supports more than 1 public IP, can work in routed mode or NAT mode, has DHCP services for the LAN and DMZ that allow for different networks even...
It's a nice unit for a small shop.
Oh, and it can block downloads from the web too - based on file extension.