I can't say I know the "best", but I've been using Norton Internet Security wich includes "parental controls" that allow you to tailor access to internet sites by Windows account name (and I use "limited" accounts and tailor access to disk folders to control what they run on the PC itself).