This was tested, and worked through a 1.2.45 gateway, so there is a chance that the list can be reduced on the newer versions of the gateway.

You will need the following list of bypasses for Minecraft for Education to work successfully:

Domain SSL - aadcdn.msauth.net
Domain SSL - api.github.com
Domain All - authorization.franchise.minecraft-services.net
Domain All - client.discovery.minecraft-services.net 
Domain SSL - cognitiveservices.azure.com 
Domain SSL - contentstorage.onenote.office.net  
Domain SSL - discovery.minecrafteduservices.com
Domain All - education.minecraft.net
Domain SSL - learningtools.onenote.com
Domain SSL - login.microsoftonline.com
Domain All - login.minecrafteduservices.com
Domain SSL - makecode.com
Domain SSL - meedownloads.blob.core.windows.net
Domain SSL - notebooks.minecrafteduservices.com 
Domain SSL - playfabapi.com
Domain SSL - pxt.azureedge.net
Domain SSL - self.events.data.microsoft.com
Domain SSL - signal.franchise.minecraft-services.net
Domain SSL - trg-minecraft.userpxt.io
Domain SSL - tynker.com
Domain All - xforgeassets001.xboxlive.com
Domain All - xforgeassets002.xboxlive.com
Domain All - xforge.xboxlive.com

All references are from the following:
https://educommunity.minecraft.net/hc/en-us/articles/360047118992-FAQ-IT-Admin-Guide