The problem taht you will have is that you cannot set a rule up to allow web traffic to external for all users as this will not authenticate.
I have full auth through my ISA but i had a problem when my antivirus wanted to update without Auth, i created this rule
Allow out bound traffic (what ever traffic you want)
from internal
to domain name set
then created domain name set to my antivirus update site and other sites like microsoft update.
hope this helps,
Regards