We have a Managed Security Services Provider (MSSP) agreement with Cisco to deploy Cisco Umbrella directly.
If anyone has any future queries regarding this issue please let us know here: Cisco Umbrella
What I can say is that the selective proxy technology in Umbrella - subject to an appropriate package - is designed to only proxy unknown/risky domains for further malware scanning etc. Intelligence-based assessment is then applied to known content rather than sending it through a proxy, which improves the performance of the solution.
The exception here is the new SIG (Secure internet Gateway) Essentials solution, which allows Cisco Umbrella to function as a full cloud gateway/firewall and therefore proxy all traffic via the Cisco Umbrella service.
