But currently my users don't authenticate to the proxy and I don't run
transparent proxy, can I still use access rules or do I need to make
users authenticate. I am looking at blocking some sites. Also wanted
to know if its possible to stop people from downloading MP3s and stuff
like that. Oh yeah and block some pop ups.

I assume the browser has to be setup to use the proxy in the first
place before the rules will work.