Is my configuration correct for transparent proxy with UT blacklist?

[droumanet]

I'm trying to use the transparent proxy functionality with my OPNsense firewall but I'm unsure it's ok.
First of all, I've followed the two tutorials:

• https://docs.opnsense.org/manual/how-tos/proxytransparent.html
• https://docs.opnsense.org/manual/how-tos/proxywebfilter.html

I can read the list, choose categories, then download and apply.

On client side, I've downloaded the root certificate and it works for some websites... but a lot of sites fall on "access denied" squid error page.
My question is about the order: is the proxy block all but not access control list (categories) or it block categories and should let go for all others websites?