If you get into the Internet Explorer Maintenance section of a group policy you can set security levels for different sites.
In my company I have set the IE security settings to their highest level for the Internet zone. Then I have defined the Truster Sites zone to allow active content, etc. Then I specify a list of trusted sites that our users will need to access during the course of their jobs. Finally I lock users out from being able to change security settings or the lists of sites in any given zone.
Now if anyone needs to run content from a web site and it is business related, I get the URL and add it to the trusted sites. All of this is done through the IE Maintenance settings in group policy.