I use the built-in Parental Controls on the Mac, which allow whitelisting of domains/ip addresses. But although it works through any app, I figured out that it only blocks port 80 (and I assume port 443). So when I installed MultiBit and ran it under my son's restricted login, it just asked me to open up access to multibit.net and bitstamp.net (for the exchange rate listing). The peers automatically connected using port 8333 without any need for tinkering on my part.
My son was very excited when I sent him .00273 BTC after I set it up for him (I owed him about $2 for something and he wanted it paid in Bitcoin).
Thanks for the help everyone!
Thanks for reporting back.
Yay, we have a new bitcoiner