You can set up a transparent proxy. As Wikipedia says,
Also known as an intercepting proxy or forced proxy, a transparent
proxy intercepts normal communication at the network layer without
requiring any special client configuration. Clients need not be aware
of the existence of the proxy. A transparent proxy is normally located
between the client and the Internet, with the proxy performing some of
the functions of a gateway or router
Doing it with
/etc/hosts is fine, as long as the user doesn't know about the file or doesn't have the permissions to edit the file. But I guess what you want to achieve would be easier if you use proxy, although it will take some time to set it up.
To set up the transparent proxy, you can use
squid. Here are some quick steps to set it up:
sudo apt-get install squid squid-common
Look for the line
http_port 3128 and make sure it is uncommented.
squid by default listens to port 3128.
acl bad dstdom_regex
http_access deny bad
This will block every URL containing
service squid3 restart
A very good guide is given here.
Here are some other links: