Interesting. If your organization manages the client endpoints I think that this could be managed at the endpoint through whitelisting / blacklisting.
Otherwise you may have some luck using Host Checker deny rules based on the ports, files or running process associated with Tor. Depending on how savvy your Tor users are, they may be able to circumvent these types of rules over time. I'd avoid relying on the user agent strings as these are pretty easy to change and fake.
Honestly, I think that this should be part your information security team's responsibility and that they should figure out how to block Tor at the Firewall layer (assuming you have firewalls between your SA/MAG and the Internet). Maybe they could add the addresses of known Tor exit nodes to their Bogons lists or a an explicit deny list.
