As posted above, I've and ITX with this (total cost about £60 from fleabay for the bits).
The Lite version is OK, but is it is light. For example, torrent sites are not blocked and porn is hit and miss. So for torrents, feel free to manually add about 100 domains, to minimize the availability. It's a bit of a workaround rather than a fix. The paid for version is quite expensive for a annual running cost and is not really suited for this size set up.
I'm still setting it up (this is a new set up, but used it in the past), so will need to try this little known trick (Google really do hide this)
Turn on SafeSearch VIP
To force SafeSearch for your network, you’ll need to update your DNS configuration. Set the DNS entry for www.google.com (and any other Google ccTLD country subdomains your users may use) to be a CNAME for forcesafesearch.google.com.
We will serve SafeSearch Search and Image Search results for requests that we receive on this VIP.