The firewall cannot control which HTTPS URLs the client is trying to access, because the URL is encrypted. The firewall can only control which sites the client is connecting to, using IP addresses, but this doesn't help if the HTTP and HTTPS versions of the site are at the same URL (and even if they aren't, you'd have to maintain a huge list of IP addresses).
The only realistic way to block HTTPS is to block it altogether. Insist that all connections must be valid HTTP (i.e. the client starts by sending an
HTTP line, and so on). This can't be done with just IPtables, you need an actual protocol-aware proxy such as Squid. (I don't know what Untangle Lite is capable of.)
You can block most HTTPS traffic by blocking outgoing traffic to port 443, since almost all HTTPS servers are on that port. Or, following a whitelist approach, only allow outgoing traffic to port 80 (the normal HTTP port).
A different approach would be to proxy all HTTP and HTTPS connections. Then you can match by URLs. This require conducting a man-in-the-middle attack on the clients. You can do that if you deploy your own certification authority to all client machines and register it there as a root of trust. This may be considered unethical.
No matter what you do, determined users will set up a proxy outside your environment and run IP over HTTP or something like that.
You appear to be either trying to fix a social problem with technical means, which hardly ever works, or to be doing your best to implement a silly requirement from management (in which case, I'd go with blocking port 443, perhaps only for certain IPs, which would allow you to report that you've done your job, no matter how useless).