We can use virtual http (or telnet)
All traffic from inside to outside on port 80 will be blocked by default.
Users will have to http (or telnet) to a virtual ip and after authentication, a access-list will be downloaded from the radius server allowing traffic on port 80.
Cut-through proxy (as in PIX) cannot be done on IOS.