On Windows, it's not really doable. It is possible on linux with mandatory access control (for example). So you can have a web filter running, but the sudoer wouldn't be able to interfere with it (at least not without lots of effort, potentially rendering the system inoperable). At the same time a sudoer can modify virtually everything else.
What options would I have on OS X to do this?