I'm in the early stages of looking for solution here and would appreciate
any advice that will shorten my search.

I have two clients with the same requirements, but with different set-ups.
It would make my life simple if I could find a common solution, though I'm
not hopeful.

Client 1.
Retail establishment with about 20 users (WinXP) connected to SBS2003 which
is also running ISA. In general, no personal internet usage is allowed and
internet access is limited by using OpenDNS. This has been working fine
until now. There is now a need for selected users to have access to YouTube
and Facebook. The request is that access be granted across the board, but
that it be logged, and or that it be controlled on a per user basis.

Client 2.
About 50 users (mostly Vista, some XP and a couple of Macs that I don't
manage) connected to SBS2008. Internet connection is through a Sonicwall NSA
240, which also provides an isolated connection to the internet for another
company in the building. Last year, Head-of-Media (now gone) requested most
of the default blocks be removed. This week client has just noticed
widespread personal use of Facebook etc. and requested that it be blocked,
along with much the other stuff which had been blocked. This of course
messes things up for Media deparment who need to maitain Facebook, Twitter
and other similar stuff.

Any suggestions?