We have the same setup as you. We run MS Proxy 2.0 sp1 Websense and IE 5 & 6. Not sure if you've tried this or not, but here goes.
If you have the winsock proxy client installed, you can bypass "WEB PROXY" and use the winsock proxy. So what you have to do is set permissions on the "WINSOCK PROXY" that does NOT allow any users (except maybe the admin) to use the http, https, and ftp. The Websense product ONLY protects the "WEB PROXY" service.....not the winsock. Easiest thing to do is put all your users in a global group like "internet user" and then deny access to this group for only those services. When they try to pass through and get denyed, the web browser will print an error. This forces the user to have proxy settings in the browser.
NOTE: if you only deny on those ports, then the users will still be able to do winsock apps, like real audio and others. Also this forces the user to use the web proxy's cache, which is not used when the user establishes a session onwinsock proxy. Hope this helps and email me if you need more, info as I am well versed in this specific topic.