I have HS_POSTAUTH_PROXY set so everyone is forced though DansGuardian but would like to exempt a few people. I am not very good with iptables and I assume it will have to be an iptables command on their mac.