I've noticed on our proxy log analyzer that a lot of users are getting
streaming music by just going to IP addresses instead of DNS names
(presumably they are linked from a web site...) Is there any way to
tell BorderManger to block URLs that have IP addresses?

I tried just setting up a deny rule for app proxy, with the IP address
range of 1.1.1.1-255.255.255.255. That caused a (not unexpected)
complete failure in browsing :-)

--Greg