Use Cisco ISE looks the best option for your scenario. WSA starts supporting ISE since version 8.8. Here is the user guide for WSA/ISE integration.
http://www.cisco.com/c/en/us/td/docs/security/ise/1-3/ISE-WSAIntegrationDoc/b_ISE-WSAIntegration.html
Please rate or mark the question as answered if this helps.