We have this issue at my company, and have resolved it through the use of "bypass codes" with OpenDNS as a web site filter. We have a basic access which has blocks by category, which OpenDNS does pretty well. We have some special company-wide exceptions for some customer sites which would fall under specific categories (A few gun catalogs or swimsuit catalogs that we print for customers fall in their weapons or lingerie categories) For this that may need access to some sites outside this, we have bypass codes that can be entered which allow access to a wider set of categories, but still block the porn and hate sites, etc. Finally we have a master code which is kept in IT which we can enter to allow access to any site, but it is valid only until they close the browser, at which point they are allowed only the standard level of access again.
There is one issue with OpenDNS and SSL sites, as you are essentially using them as a proxy and the SSL certificate match fails, so it is not a perfect solution, but potentially a good for for the OP's needs.