to block execyutables from most pages but still allow updates (java, windowsupdates, filezilla,....) you can create a security policy that allows access to certain 'good' URL categories and allow downloading executables, and a second policy to block all other exe downloads