I am responsible for network security at a company.
I plan to configure only the Box domains of our partners on our firewall's allowlist. Our security policy does not allow registering domains with wildcards, so I am referring to the guide in the following FAQ (Section '1c. Specific hostnames'). It appears that free personal domains (app.box.com) are included among the core domains to be configured:
Configuring A Firewall For Box Applications and Services.

I understand that configuring in this manner would allow free personal domains. However, if I want to block all free personal domains, could you please advise me on how to proceed with the configuration?