Block IE8 and below from internet access

We, unfortunately, have an application that requires IE8.  Fortunately it is an internally hosted application.  What we are looking to do is to block IE8 and below from accessing or being accessed from the internet.  I see where this can be crfeated in the firewall rules to only allow IE8 to access our intranet sites and designated machines.  However I'm not seeing anything to specifically identify these older versions of IE.  My first inclination is that this would have to be via hash and that I would have to obtain the IE8 and under executables to obtain this as monitoring applications would onley show iexplore.exe.  Is this correct or is there a simpler way of doing it that I'm missing?  The moajority of our client's are on 12.1.6 MP1 whereas we recently upgraded our SEPMs to 12.1.6 MP3.