Here is a different solution.
We had a similar problem at the school board with youtube. Some of the responses ended up getting google dns names. (Go figure!) I simply created a dns rule and applied it to everything. If you made a dns request for youtube & that included our dns servers, the packet was dropped. I set it up as a timed policy so that it operated during school hours only.
My clients are happy with that. If you wished to refine it & allow certain people access, you would have to isolate them on a specific network or in a certain address range and allow them access to a tertiary internal dns server that is not restricted by the dns policy. You would also have to create a policy restricting who could make requests to that dns server.
Make sure you fully inform your clients of the full implications of the policy you implement, but I can tell you I have no irate calls from teachers saying that " little Johnny accessed Youtube. I thought you said it was blocked!"
Victor