General Executable Block with exceptions for specific hosts

Trying to accomplish the following:

1. Allow a single host (IDed via IP address) to download executables from a list of approved sites (Identified via URL filter).

2. Scan the files that are allowed to be downloaded from the URLs per #1

3. Block all executables (except a narrow subset) to all clients.

Thus far, I have been able to accomplish #3 via static URL exemptions, but that excludes the permitted files from any anti-malware protections at the firewall. Have not been able to get #1 to work consistently. The most recent iteration was to clone the catch-all that implements #3 with with the full list of permitted sources, but apply to it specific hosts and a narrower list of protocols. The intent is to allow a single host access to EXEs from certain sites to control what software is brought into the network while generally blocking everything else. The URL Filter associated with #3 is the default filter and allows access to certain MSI/Executables that can't be centrally managed (such as AV updates, certain .xap files for particular local government sites that require Silverlight). Any suggestions would be appreciated.