Hi, I did this on my MSM765. Now FW 6.6.8.2-23491, but this was some years back
You will need to create an extra IP interface and vlan to egress the traffic out to your proxy or firewall.
Add the egress VLAN, and IPv4 interface under Controller/Network/Interfaces - give it an ip address. My egress vlan is just a pipe with 2 address, 1 on each end, so I use .1 on the controller, and .254 on the firewall where I dump the guest traffic and NAT out to the internet.
Make the egress vlan available on any switches between the controller and the destination. My firewall is the destination where I NAT the traffic out. Yours will be on the proxy server.
On the VSC, use the VSC Egress Mapping to send the traffic you want to the egress vlan. I send all (unauth, auth and intercepted) to the egress.
The traffic will have the source addresses 10.140.0.* assigned by the DHCP server on the VSC. You will need to route return traffic headed back 10.140.0.0 to the interface on the other end of the EGRESS vlan (.1 in my case) which is on the MSM
Hope this helps