Maybe my configuration could help you.
In my case, the RuleSet only applies to an AD specific group.
In more detail:
Then, I have two rules. One for the exceptions (Windows group with users) and the other with the time based rule. since this is particular scenario, consider using it)
Regarding the Time based rule, there are two criterias. One with the time range of when is applied and the other with URL categories. Once again, in my scenario, I only wanted to block certain categories during work-hours, like, Social Networks, Media, etc.)
Here is the time range rule in detail. (24h format)
I hope this could help you to get onthe right track.
Hope you are doing well, thanks for your post this is really help full for me.
The link shared by jon is really helpful as it has different types of time based rules.