A. Yes, you need some type of firewall log anaylzer that would calculate this for you.
B. Yes, you need to get a URL filter license (limited management features) OR setup your own websense server and redirect your web traffic (redirect requires no license), but websense is not cheap :).
C: Yes, use different policies for each group. You do not want to go down this path. I don't know how large your nework is, but micromanaging this yourself can be very time consuming. (Websense can do all this for you).