[photon]

How much functionality do you want to leave everyone with?

This will be pretty difficult.. You could block every port except port 80 and port 443 (for web browsing) and that won't stop Tor or the VPNs since they operate over those ports as well.

You could try to maintain a block lost of IPs to block onion routers and known VPNs, though that's a full time job really. There might be a commercial list to subscribe to though.

You could try attacking the problem from the other side; lock down the PCs or use software that prevents some applications from running.

Is this for a company? I think a technical solution to users surfing what they shouldn't be surfing isn't really the best way to go, or at least shouldn't be the only portion.. communication and legally binding computer usage policies that are signed by the users should be involved as well.