iTunes radio streams use TCP 42000-42999, as per the following document:
... so blocking those ports on the network should shut down radio streams.
Alternatively, if you're in an enterprise situation with managed clients, the information on kParentalFlags_DisableRadio from the following document might be worth checking through:
If you block the following URLs, this should block iTunes Radio without blocking the rest of iTunes and the app store.
*://streamingaudio.itunes.apple.com (I'm pretty sure it's https, but I blocked both to be on the safe side.)
I've seen other documentation that mentions this site as well, but I didn't see it in the monitor.