Personally, I would go the IPCop route, as it is a cinch to setup squid on it, and I'm sure you can find an add-in to do what you want from a logging standpoint; I know with the "Advanced Proxy" addin from
http://firewalladdons.sourceforge.net/ you can authenticate users as well. In any sort of LAN setting, you really should have some sort of caching server, if only for the vastly increased performance, not only for the logging capabilities.
I'm not sure how much work logging by user would be, but the squid logs definately track by IP no problem, so when I've used it, tracking the user was easy enough once I had the IP, I just started auditing logon and logoff events, to determine what user was using a particular PC at what time, which is maybe a good practice anyhow.