Depending on which size/model your ASA FW for internetbreakout is, you could create a second context based firewall running on the same fysical hardware.You could then have the diffent clients run out the same interface on FW context 2 and make WCCP ...

On the WSA look under: Web Security Manager - Access Policies - Click on "Web Reputation and Anti-Malware Filtering" policy. Her you set how to monitor or block the different malware categories and at the buttom "other categories"On the SMA look unde...