Yes, curated whitelist of domains sounds good to me.

Of course, everything by Google they will still allow.

My favourite firewall bypass to this day is Google translate, which will access arbitrary URL for you (more or less).

I expect lots of fun with these.