Sophos xg Vs chromebooks

Hello! We have a new xg utm, we also have a few Chromebooks, we want the chromebooks to be presented with their normal login to g suite prompt, then drop to a captive portal due to them not auth'ing on the domain. We can put exceptions in to do this, but the exceptions are to broad and open up lots of sites.google.com/sites/ sites which students are then using to access games (we're a high school), does anyone know the accurate narrowed down exceptions for us to achieve this?

Thanks!!!