Depends how many machines and users. The best free one I have seen is K9 from bluecoat. It uses their commercial filter lists so you do not have to subscribe or keep lists of sites updated. This is mostly targeted at home users who want to keep the kids off bad sites.
Once you start using an appliance it gets tough. You can use a proxy or a firewall they accomplish the same thing just in a different way. In both cases you manually must keep lists of sites updated or pay a service for the lists. The yearly charge for the filter list many times exceeds the purchase price of the equipment.