Just a status update for anyone who might be interested. I have managed
to get LinkWall working in "allow only these web sites and none other"
mode. It took a bit of doing, and in particular the way I manage which
users are in which group is different due to the way the rules are
handled differently by pure BM/NDS and by LinkWall. By way of
background, I was given a directive to complete restrict Internet access
for most users to a specified list of allowed site and none other, and
had implemented that using BM Access Rules only.

At some point, I will write up a page on my experience getting LinkWall
going (because most people don't use it the way I am but rather to
maintain a list of forbidden sites only while allowing all other sites
to be visited), but my initial reaction to using the product in a
production environment is that it is well worth the time - production
environment changes are blessedly simple now and, more importantly, can
be handed off to a local user/admin without needing to get into