I dont recall the details now, but yes, I've been down this path with some of these special egg people who just had to have macs. They aren't even creative types... these somehow got in here as "unix workstations" when Sun stopped selling desktop class Sparcs. Oy. I digress.
I don't recall having that problem with them, however, in order to get them to update and be able to pull down their updates from apple, I had to whitelist way more than I wanted to on them. They were indeed a pain.
Makes me wonder if any Mac friendly support engineer has crafted a FAQ or best practice on Mac management.
It's entirely plausible to me that perhaps if the mac can't get to a given appley site without getting concerned with ssl interception or the like that it might try taking matters into its own hands and start trying to ignore the proxy settings trying to phone home.
What version of MWG are you on?