In general, this is an unsolvable problem. Consider the situation where a user uploads encrypted zip files: you can only unzip them if you have the password for each one. Without that password, you can see the name of the contents, but nothing else.
Each of these files may be perfectly legitimate: maybe they are Word documents. Your firewall can see that they are Word documents, just not what the contents are. You might even be able to guess the passwords for a few of these zip files, and unzip the Word documents, to find that they are indeed valid Word documents. However, Word documents are, in modern versions, zip files themselves, which can essentially contain anything. Your firewall wouldn't have a chance of finding that without knowing the password for the outer zip file, and then inspecting the contents of the inner file too.
This isn't the only combination that will allow arbitrary files past most firewalls. Consider sending a Word document which contains a string of Base64 text, which, upon decoding, is a malicious binary. Whatever tricks you think up to prevent files being introduced to your environment, it's possible to think of ways to bypass them.
One better way to deal with this problem is to allow data in, but enforce the use of on-access malware detection. This triggers as soon as a file is decrypted, or reconstructed, and deletes it, or blocks access to it. It also has the advantage of working against malware introduced by means that bypass firewalls - USB sticks, mobile devices plugged in to charge, files transferred to laptops whilst on other networks.