DHCP advertise an http proxy to it with a PAC file and block non-proxy communications. It should do the right thing eventually, at which point you can catalogue

DHCP advertise an http proxy to it with a PAC file and block non-proxy communications. It should do the right thing eventually, at which point you can catalogue the usual traffic exchanges and then block anything not in them and/or just the software update URLs (which requires inspection over time, as there may be many).