My employer MITMs all content using the first approach. I don't think they have the storage to log all content, certainly not all downloads, but they do scan it

My employer MITMs all content using the first approach. I don't think they have the storage to log all content, certainly not all downloads, but they do scan it for DLP, e.g., uploading stuff that looks like source code. It seems genuinely useful for things like preventing accidental pushes to GitHub (which is a thing I've seen happen multiple times). Also, my employer provides a guest wifi for personal devices that doesn't do MITMing at all, and if for some reason I were watching Netflix at work, I'd presumably watch it on a personal device anyway. (Even if I was projecting to a conference room at work, I'd still plug in a personal device to the projector.)