We use iBoss with our 10.9.x macbooks, for anything 10.7.x-10.9.x we have the mobile client setup so that it uses the local account to determine what filtering rules to use while on or off campus. This is an issue going forward for us because we are planning on going with 10.10 next year and we will have to move everyone to the proxy method unless we end up switching to another provider. This is something we are still looking at.
For iPads we use a PAC script and just apply the settings through the mobile profile. This requires the users to authenticate through AD on our end with their usernames and passwords. This causes us some headaches depending on users at home setups, but has been fairly limited.
We don't allow the app store to be visible to our users so they cannot install anything we don't give them access to in self service. We have tested a few of the flash based browsers and they are capable of going around the firewall when the flash compatibility mode is enabled.
As part of the setup for the mobile client on 10.9 machines you do have to install certain applications and scripts for it to work correctly, that is something support can help you with though, if you need it.
