I can tell you how Squid and Dansguardian works.
Squid is an HTTP proxy. This means instead of a browser sending HTTP requests directly to the destination address they want to contact, it gets sent to Squid instead, which under normal circumstances will reissue the request to the destination address, receive the reply, and forward the reply back to the original requesting browser.
Where things get interesting is in Squid's ability to do more than just simple forwarding. One thing it's famous for is caching; this is where it keeps frequently accessed pages on disk, and uses the disk to fulfill requests instead of contacting the destination server for the same page over and over.
Another thing is filtering; Squid can, in response to a HTTP request, send back an error page (saying the page is blocked, for example) if the URL matches patterns, or if a script denies that URL. Dansguardian works like this I believe; a script is executed for each HTTP request that checks the URL, and issues an approve or deny answer to Squid.
Now, unless you want users to bypass this easily, Squid must be the only way for HTTP traffic to get in and out of your network. Browsers can be explicitly set up to use proxy servers, but a better way is to set up Squid for transparent proxying on or near a gateway device in a network. You'll need to configure your gateway device to redirect all outgoing port 80 traffic to Squid's IP and port. This makes Squid receive all outgoing traffic on port 80, intercepting all HTTP requests transparently, thereby forcing all users to go through the proxy. Then any policies implemented on Squid will apply to all users in that network.