I think it goes like this. Definitions define youtube as a dns host create a packet filter at the top of the list internal network-> any -> youtube -> block.
This only works if you ARE not using the http proxies.
Further caveat, if a user is sent a youtube link outside of youtube space this will not block it. I suspect you then have resort to blocking packet types (ports).
