A whitelist sounds like it would be far easier to maintain, though each user would be on the hook for that.

No more cat-and-mouse that you'd have with the blacklisting approach, at least.