As mentioned, technical savvy employees will find a way to bypass any of the suggested restrictions mentioned:
hosts file could be changed or bypassed using web proxy or other solutions; DNS could be bypassed as well by using web proxies or by altering the DNS configurations (see Ozyman's scripts) and if you managed to limit those as well, portable version of TOR will probably bypass any other restriction you'll define.
The best solution is education. Explain your rules and reasoning to your employees and monitor they use of web access to verify they apply to the rules you described. But be aware! There’s a fine line between being Big Brother and keeping employees from wasting too much time on the Internet.
If you go with this option, note that rearranging the office to force your employees to sit with their monitors in your sight, might help as well.
If you are thinking of logging your employees traffic, mind this:
A tool like Net Spy Pro allows you to monitor employee Web usage from
a single desktop. This particular tool even allows the administrator
to view employee bookmarks and favorites. Although some think this a
better approach than implementing policies and preventing access to
certain (or all) Web sites, many people view this quite the opposite.
This link also provides two other techniques of handling demands like your own, OpenDNS that was mentioned earlier:
OpenDNS enables you to manage the Internet experience on your network with pre-defined category bundles, custom policies, whitelist-only mode and domain blacklist and whitelist. Create exceptions using time limited or persistent bypass codes or credentials.
Depends on your needs - whether you want to limit your employees from accessing facebook, or visitng malware sites - other free DNS solution available. Such ones will be for example Comodo's Secure DNS or Google DNS, these two provide protection and not web filtering.
Also, since some of OpenDNS features are for enterprise customers only, check with your ISP for content filtering, in some countries governments force ISP to provide this option (also [possible to set the limitation to specific hours)
The other tool mentioned in the link is PacketFence which is...
...a fully supported, trusted, Free and Open Source network access
control (NAC) solution. Boasting an impressive feature set including a
captive-portal for registration and remediation, centralized wired and
wireless management, powerful guest management options, 802.1X
support, layer-2 isolation of problematic devices; PacketFence can be
used to effectively secure networks small to very large heterogeneous
I don't have any past experience with this application so cannot testify for its quality, if you are looking for commercial alternative to Packet Fence try here.