Not sure there is a Best Practice as no two networks are the same. However, a good practice would be to have the gateway of last resort, IE the firewall use WCCP to redirect whichever protocols you want the WSA to scan, http, https, ftp, etc. and redirect all that traffic to the WSA, then static NAT the WSA to a public IP so all traffic to the net comes up as the WSA.
An upside of this, when you have an incident and need to track down who did what based on the public IP, you will have to know where the destination was, then go through the logs on the WSA to find the internal IP involved, where if you were just natting out to the internet , you won't have those records.
Another upside, if you have servers, or other hosts that need to bypass WSA, either permanent or temporary, you can create a WCCP exemption on the firewall for that host instead of having to write rules on the WSA and hope they work, as they don't always work as I keep finding out.
I am not 100% certain you could do this, but maybe have one interface in the Inside for internal host proxy, and another interface in the DMZ for DMZ proxy?
