Locking down app-v browsers

You could use a proxy .pac with Firefox for example file to restrict internet access. Only allow access to a specific (intern hosted) URL with the .pac-file.

Include (or connect with DSC/CG) old JRE version(s).