How can I set a policy to restrict a user to only one website? I don't have the option of using a proxy server.

It takes a few steps. First, logon to the workstation as the user you want to restrict. Set the homepage in I.E. to the webpage you want them to go to. Right click on the icon that they will use to start IE and in the path, add -k to the end of the path outside of the " ". This will start IE in kiosk mode with no buttons or toolbars. Next logon as admin and copy their profile to the shared profiles folder on the logon server (under WINNT/profiles/username). Make the profile mandatory by renaming the ntuser.dat to ntuser.man - now they cannot change their profile. You have to use System policy editor to remove the Run command from the start menu or they can just type in a web address to go to there. Also if there is more than one place that they can launch IE, you have to make that change of adding the -k to them as well before you copy their profile to server. I had workstations where all the student could do is go the internet to one website where they wrote their practice exams - they could nothing else. I added IE to the start up menu and removed everything else so as soon as the computer was logged into, it launched the exam website. I had my best students try to hack it to get out to other sites and they could not. This was using NT Server and NT workstation but the same should apply with Win2000.

Am I copying their local workstation profile to the server and if so, do roaming profiles have to be implemented?

Yes you are copying her local profile to the server which makes them a roaming profile but by renaming the ntuser.dat to ntuser.man, you are making the profile mandatory. Whatever computer she logs into, the restricted profile will follow her. You can restrict her to one computer only in User Manager by naming the workstation she is allowed to work on. It is still called a roaming profile but the naming of the one workstation you want to limit her to will override roaming automatically. Hope that makes sense.

right-clicking a link in kiosk mode, selecting "open link in new window" will launch a new window in normal mode, ie all buttons an toolbars

Try noaccess.rat from M$ website

When I was finished with the mandatory profile and the system policy editor, right clicking was disabled so there was no way to open a new link or use keyboard shortcuts. Also the one website that they were allowed to go to had no links to outside websites to start with so nothing to right click on.