How to block certain web sites from active directory domain controller?

You may navigate to User Configuration\Policies\Windows Settings\Internet Explorer Maintenance\Security\Security Zones and Content Ratings then tick "Import the current Content Rating Settings" and then click the Modify settings button. To add a site, type it into the “Allow this website:” text box, then click the Never button. When you have configured all of the sites that you want to restrict, click the Apply button, as shown in the following snapshot.

Also, you need to tick the "Users can see websites that have no rating" check box.

For more details, see below:

Restricting Specific Web Sites in Internet Explorer Using Group Policy
http://www.windowsecurity.com/articles/Restricting-Specific-Web-Sites-Internet-Explorer-Using-Group-Policy.html