Your difference of opinion is exactly the difference between two distinct philosophies regarding network access control. These philosophies also demonstrate the classic trade-off between security and usability.
Blacklisting, similar to your firewall admin's stance, is a practice of allowing all but a defined list of traffic patterns through. This is the easiest to do in terms of usability and administration, but is rather insecure and borderline naive. To claim blacklisting is safe, is to presume that you know all possible threats to your network and have added them all to your deny list. To know all possible threats is obviously impossible and, even then, to selectively include all those threats on a deny list would cause the list to be enormous and unmanageable.
Whitelisting, the philosophy you were "raised with" (so to speak), is the exact opposite. It presumes all traffic should be denied, except for that which is specified in your allow list. This is the more secure option, but can also have a great impact to usability and management overhead. It is based upon the "Principle of least..." rule of security - you only allow your users/computers/programs/etc. to do what they really need to do. The up-side to this is that you know exactly what it is that your network is allowed to do. While this alone will not make you immune to all threats, it will help protect you against a good portion of the unknowns. There will still be ways to circumvent this (e.g.: with tunneling through allowed ports/protocols) but it will be much more difficult than against a blacklist-oriented approach. Of course, the down-side to this approach is that it can often be more difficult to troubleshoot problems with networked applications while still maintaining the "Principle of least..." rule.
Each approach has its merits, and its weaknesses. In the end, it is up to you (or your company's executives) to decide which approach is most reasonable for your organization. A good defense-in-depth approach that includes protective measures other than just the perimeter firewall is also essential to mitigating risks left open by whatever firewall configuration or hardware you choose.