This is a tricky subject as it mainly depends on the technical skill and/or determination of your users. You obviously have some control over the internet gateway as you have tried to apply some filters though without complete success.
The best approach may be to have acceptable use policies in place stipulating what users are or are not allowed to do. This is because it can be easier to monitor usage than to control it.
If you already have ISA Server, GFI WebMonitor (
www.gfi.com/webmon/
) is an addon that allows you to monitor file downloads.
Of course Squid, (
www.squid-cache.org/
) can be used.
Another approach could be to control file downloads by size rather than by file type.
