Blocking Outbound Traffic in Your Organization - Best Practice or Overkill?

Just wanted to get a feel for everyone's opinion on this:  Currently on our firewall we block all outbound traffic except 80 & 443 and a few other usual suspects.  This is good cause it's locked down but it does cause the occasional problem e.g. a visitor on our wifi uses a proprietary email or VPN client or something and needs a different port outbound opened up.  I've seen organizations allow everything outbound.  Just curious what everyone does in their organizations cause on the one hand it's more locked down but on the other it makes the occasional inconvenience as mentioned above.  Thanks in advance.