sorry - been a little busy with my own stuff.
I cannot believe Sonicwall did not grasp the concept.
When the users access a proxy through ISA, the traffic leaves for the firewall but with ISA's address as the source.
By telling the Sonicwall that it can only accept outbound http/https etc from the ISA's ip address you immediately stop ANYONE getting out to the Internet over http/https UNLESS they have gone through the ISA server. Because you have set 'authenticated users', only users who have authenticated (logged on) can use the ISA Server.
Forcing the issue through wpad/dhcp 252 etc helps the situation also of course.