interesting , just points for the thoughts :)
kazaa is a client server, which means, it reaches out to the server and the server has to reach back to the client.
if you installed the proxy client it will reach out but then when coming back the isa will block it, you would indeed open up the port 1214.
and then still isa has to forward that packet back to the particular client that started kazaa.
I have read a couple of times that you can modify the .ini file on the client so a particualr program would know how to bind that port to that client and then it should work (something with netmeeting).if you would use isa just as a nat (without the firewall it should work). A approach could be also to give the admin permission to use all protocols and the from the client check if it works for the admin, and then narrow then the protocol.
btw isa is a firewall of course, if you let kazaa , etc through its a hole for trojan horses virusses etc to go throught, if teh network gets infected you wouldnt know where it came from. so whats the point to use ISA anyway.
I will check on my system and let you know in the weekend.