To block certain applications on an SSID you'll want to go to Configure> Network Policies> Open the Network Policy> Go to the Wireless Networks tab and open the SSID> Open the User Profile> Under the Security tab enable Firewall Rules and create a new IP Firewall rule by clicking ADD. At the top of the New Firewall Rule page click the menu icon next to Service:
Go to the Applications tab and search for the application in question, for example "facebook". Select the services you want to block and click Add Service. Leave the source and destination IP at "any" to block all traffic to or from these applications. Set the action to Deny and save the firewall rule.
Once you have created all the firewall rules you need, you'll want to push a configuration update out to the APs so they'll use the new rules.
