Segregate web access from internal network access?

Hello all,
Is there a way to segregate a user’s internet access from their internal file server access? A new client is worried that any employee could upload sensitive material to the internet. Our workstations are all Open Directory managed users, with network homes for some users, and localized home directories for users with more intense storage and read/write requirements.

My initial understanding is that as long as a workstation has access to both an internal and external network, a user could transfer a file from the internal network out to the internet. Is this the case? Would setting up two network interfaces on separate subnets prevent this? (My guess is that as long as the workstation can access both networks at the same time, it could send a file from one to the other, correct?)

Any help or suggestions would be appreciated!