Maybe at your work they do, but most networks don't monitor outbound ports, or if they do, they permit the usual ports including the one for ssh and many other low numbered ports as their use is too ubiquitus. On the other hand, you could use a different port, say 80 for the browser, when using ssh to masquerade as that. Even a packet Sniffer would be helpless in that situation, because it could not unscramble the packet to determine the real protocol. But there is nothing that can be done if the bandwidth usage is unusually high, and you don't need all your technology and efforts to determine something as simple as that. If he is just browsing the web, he'd defeat you. If he was streaming video for a short time, he'd defeat you too.
Other than ssh, there is also Tor, which proxies the packets through an anonymous network and unskins them like an onion at each node. Unlike ssh, the proxy nodes constantly change, including the entry and exit nodes. With ssh or Tor, URL blocking, behaviour monitoring, sniffers, port blocking and port monitoring all goes out the window - sorry!
Both technologies would defeat what you use, unless you resort to something physical like you suggest - a video camera surveying the user, or logging their keystrokes. In that case, then you work at a very coercive environment - if even being fired because of unsanctioned behaviour would as you say, "would have a hard time finding work at any job that ... use a computer". So your company would go out of their way to ensure that the employee they dismissed would have trouble finding work again? Think about what kind of company would do that then.
If your company is very interested in controlling where the users go with a browser, a simple thing such as forcing the browsers go through the company proxy would work most of the time. Most companies would rather let the user go wherever they want, and use monitoring of packets, logs, etc., to catch them instead. Far more costly to do it this way and you catch them after the fact, if you do.
I think this "time theft" of one's employer is a thing that has gone too far for some companies. They really ought to use a little bit of common sense. Using a computer for unsanctioned activities is like using a phone for personal calls on company time. Both are not good if done excessively. The reduction in work performance is going to be obvious without the need to monitor what a person is typing or doing on his computer. The network usage rates are going to be obvious that something unusual is going on at their computer. Virus checkers would catch viruses which would help IT staff determine if a user was going somewhere or downloading something they should not have been.
It has been shown time and again, every effort at securing a system is eventually defeated - when you are inside it. Even if you locked everything down, and your company has a web server it houses internally, your users could go out to the internet through that web server, using it as a proxy. And if you didn't have a web server, your user could disconnect from the network and use a rocket stick and surf using the cellular network. And then there are notebooks and smart phones, and next year tablets (that use the cell network). These days, for most companies it's a total waste of time to try to lock it all down - and like I said, even with all that information that it should know about how to get out, if your company still insists on locking it down, then I would question how legitimate the concern is, what the real risks are, and how sensible company heads are.
