The theory is easy if you are not using the proxy. Go to Webconfig > Network > Firewall > Egress Firewall and change the mode to "Block all outgoing traffic - specify allowed destinations" then specify the allowed IP's. In practice this is not always so easy if the FQDN does not resolve to a single IP address. Google and Facebook (as an example) round-robin their IP's for load balancing so you would need to unblock a whole block of addresses for them to work reliably and it does not help using FQDN's in your firewall rules as the FQDN is converted to an IP address when the rule is loaded and it does not get re-evaluated until the rule is reloaded. Use this site to wok out what you may need to unblock.

This method blocks traffic from LAN to WAN but not from ClearOS to WAN.

As an alternative you could use the Content Filter with authentication or there is a more recent app, Gateway Management which may be more suited. There is a free (Community) and commercial version of Gateway Management. I don't have experience of these apps.