Firewall inspecting Apple traffic and dropping traffic

HTTPS interception refers to a corporate firewall process by which the outbound firewall intercepts traffic leaving the network substitutes any certificates with a corporate certificate and then decrypts, inspects and re-encrypts the traffic before allowing it to leave the network for the Internet.

Apple has a zero-tolerance policy (more or less) towards this practice and that means that Apple's services will reject any connections where it detects certificate substitutions. In other words, the personal devices will be unable to reach Apple's servers - so no updates, no iTunes, no FaceTime or Messages, iCloud services, Apple Pay, etc, etc.

All of the interception exclusions Apple lists are specifically for Apple's own servers and services - this list has nothing to do with Social Media (except maybe to the degree you consider Messages "social media", I guess...). The best practice to ensure users don't have a bad experience is to exclude Apple's domains from certificate substitution in your security appliances so they can connect to Apple's services.

If you exclude everything except the iCloud Private Relay servers, then the users won't have private relay services. But really, who cares? They are behind your security appliance and firewall, which is an anonymous ID service itself (everyone on your network looks like everyone else on your network) but conversely, it's a corporate network, not a personal network connection.

Of course, all this assumes that you can identify not just the domains for private relay listed in the article, but any regional variants Apple also maintains - and that domain level filtering in your security appliances works well. But it is probably the best available hybrid approach...