You could still just proxy everything through a single endpoint. I honestly don't know why people would run software that phones home to function, yet are worried that it phones home...

I'm just saying large corps move incredibly slowly, especially across internal silos. A big effort just to deter a couple of users fiddling with their network settings.