Corporate web traffic proxy, which one to choose?

Question

Active Directory

Greetings!
I thought it would be an easy question, but it wasn't.
The bottom line is that an organization (30 people) needs a web traffic proxy server with authentication in the active directory. At the same time, the gateway, which is now the default for clients, cannot be changed (according to the conditions of the task). Those. to register proxy in settings of workstations (Windows 7) through GPO and all.
Proxy should show statistics on domain users, both http and https traffic. Have some kind of categorizer to restrict access to a particular category.
The solutions I've looked at suggest either being a full-fledged gateway (with two interfaces) or failing with SSO authentication. Here's what I studied / set:
Kerio - expensive
Traffic Inspector - you need two interfaces
Ideco - need two interfaces
Entensys Web Filter (former usergate) - authentication does not work. TP is silent.
Does anyone use such a scheme? Please show what you are using or have used.
Thank you!
PS Squid with daemon binding for AD integration is the latest option.