Purely from an IT perspective, it’s better to blacklist than to whitelist. Back when I used to implement this sort of policy for performance reasons, I used to look at the top ten non-work-related traffic generators each month and blackball them. The biggest culprits at the time were file sharing sites, stuff that streams(*) and flavour-of-the-month sites(**). The vast majority of network traffic was generated by a small minority of sites.
From a business perspective, it’s arguably better to whitelist. Need access to a site, let us know and we’ll allow it. Pretty draconian way of doing things though.
These days, most filtering is done by content. I can’t imagine maintaining manual lists of black/whitelisted websites. More cost-effective to pay for a filtering company / software just to block by category.
(* – the biggest ‘streaming’ bandwidth hogs were, somewhat surprisingly perhaps, a BBC news feed ticker desktop add-on, and live desktop wallpaper changers)
(** – Big Brother updates, cricket scores, that sort of thing)