WebControl isn't my area of expertise, but when you ask:
>Which addresses are best to add to our exclusions list?
Try this one:
Thank you for the recommendation wwarren. I opened an SR with the support team and here are the exclusions they recommended. It wasn't until I added the exclusions in both our proxy and firewall that the Web Control Plugin began to work correctly. The plugin uses an outbound connection over port 443.