That depends on what firewall, proxy server or content filtering
gateway you're running at your Internet gateway, and then you'd have
to ask the manufacturer of your firewall or proxy server. Even then,
you can block downloads for common transfer protocols like HTTP, FTP,
SMTP, NNTP and peer to peer, but users might still be able to download
..zip files containing such files, rename such files to a different
extension, or use encryption such as HTTPS which you'll never be able
to scan for content.
Configuring your firewall to entirely block NNTP and/or peer to peer
file sharing like Kazaa is a start. Another thing that's more or less
necessary is to write and publish a written policy forbidding such
things, along with documented punishment for doing such things,
because there will be cases where you cannot block such downloads
entirely but you can detect such downloads on computers after the
fact.
