It sounds to me like the question is mostly "How do we prevent ports we intentionally allow out for other protocols from being used for SSH tunneling instead?". I don't know of a good option, particularly on ports which don't have a predefined service object with a protocol signature.
For example, let's say some vendor tells me I need to connect to their application over port 12345, and that it uses a binary protocol rather than HTTP or HTTPS. I can't use HTTPS Inspection to intercept TLS and verify it's really HTTP inside, since it isn't expected to be. There's not a predefined service object for port 12345 or for this vendor's binary protocol, so I can't enforce a given protocol signature on all traffic over the port.
.PNG){kind=link}