As a previous poster suggested, about the only shoestring option that you have (and able to withstand legal scrutiny) is whitelisting. The downside is that it's a morale killer and you have to answer regularly to accusations of playing the morality police.

As you stand a chance of experiencing legal penalties, your leadership should belly up for a proper tool. My personal pick through my years of managing this function is Websense Web Security. It's not as expensive as you might think, especially for what it brings to the table. Their pricing fits nicely for nearly any size of organization. I currently manage a 5000 seat deployment, and I couldn't be happier with the job it does for me, or the minimal amount of care and feeding that the system requires.

-SS