Content Filtering and Clamav without Transparent Proxy

[WhiteTiger]

In a previous post it was clarified to me that activating HTTPS is more of a problem than a solution.
However, if I want to maintain the ability to filter messages based on UT1 categories and scan with ClamAV, what should I do?
Is it sufficient to disable the HTTP and HTTPS Transparent Proxy and enable authentication?
Or will I still have the "Man in the Middle" problem?
Do I always have to activate a certificate?

Following the advice received, my idea is to separate two VLANs.
In the work VLAN, I need to do filtering and use ClamAV.
The guests' VLAN will only be used to allow browsing and therefore I can also avoid filters and ClamAV because they will not have access to the internal network. For this I could also accept the proxy by-pass.

Unless there are better ideas.