I had this conversation with a colleague about preventing viruses/trojans from accessing the internet from within a corporate network. He says that a proxy server for http traffic with an unusual port would be an effective barrier. In my opinion, the viruses now are smart enough to figure the way out by using browser settings or in a similar fashion. Now we use NAT, so we are trying to figure out whether it is worthwhile to implement a proxy. Cons are that notebook user would have to change their browser settings every time they are connecting from anywhere beyond the corporate network.

So the questions are:  

1) how effective would be a proxy server with an unusual port compared to NAT to disallow viruses/worms access the internet  

2) if we do implement the proxy solution, what is a convenient way to switch browser settings for notebook users?