Andy,
I haven't used Microsoft ISA, in a long-long time. But I hear it's a good product. So even if your requirements are not met directly by a feature or config setting, you should be able to realise goals by architectural engineering.
Quite a few of my customers wanted this, and I managed to do it with SafeSquid. Though, let me warn you, this isn't done by mere configuration settings in SafeSquid too!
But this is what we do -
We set-up two instances of SafeSquid, say proxyA & proxyB.
In proxyA we create a "Profile" say 'free-web-sites' for the web-sites, that may be accessed without authentication, by everybody. And then we create a rule in "Request Forwarding" for '!free-web-sites' ( i.e. all requests that are NOTprofiled as free-web-sites ) to be forwarded to proxyB.
Next we simply create a rule in "Access Restrictions" in proxyB to deny all requests, but allow only those that are authenticated.
Now the users will be challenged for authentication whenever they try to access any web-site except for 'free-web-sites' (proxyB will actually do the challenge)
I gave the example via SafeSquid, because when customers demand, content filtering, that's more than mere url filtering, and I am more comfortable with it's design. But I am sure you should be able to do it with any other good proxy server too!
