Wouldn't malware simply spin up a new VM with a new IP to trivially get around single IP blocks? Wouldn't such blocks also put a lot of strain on the NOC to maintain.
If I were in your position, I would set up a proxy that appears as http traffic (so you fly under their radar).