The truly paranoid may elect to use the 2.4 kernels' Netfilter4 facility (adding stateful packet filtering) or a commercial application-level proxy gateway.
The Gateway is a Windows application that authenticates users with single sign-on, connects to corporate content stores, and monitors documents for updates.