Blocking attachments can be done a couple different ways. The easiest way is to obtain third-party software. This type of software typically either scans the email at an SMTP gateway before passing it on to an Exchange server, or it can scan Exchange mailboxes and delete/block attachments as they arrive. Many anti-virus vendors also include attachment blocking features, so you might look into one of those solutions and kill two birds with one stone.
As for download blocking, you can do that a couple ways, as well. You did not mention what browser you are using. However, if you are using Internet Explorer, you can use the IE Admin Kit to deploy a restricted version of the browser that does not allow them to configure proxy settings. Alternatively, you can require authentication to access proxy services and prevent folks from getting out through the proxy. This secures access regardless of what browser you are using.
Now, you probably want to know how you can allow browsing but deny downloading. Unfortunately, you cannot. After all, browsing is a form of downloading. If you allow them to browse, you allow them to download.
This was first published in August 2001