The problem you are trying to solve is very complex. As far as my understanding goes, you want to prevent the exfiltration of data by your employees, but understand that a determined attacker may as well find ways to evade your filters. I will have a look at your situation, problems that may arise and solutions to them:
How do you inspect SSL/TLS traffic?
SSL/TLS was designed to prevent a third party (you, in this case) from reading or modifying the communication in any way. This can be circumvented by using a SSL Proxy. For this, you will need to create a Certificate Authority and have every client in your network trust it. This should not be an issue for your IT department.
Once this is in place, your proxy can inspect SSL/TLS traffic and - if required - is able to block certain communication?
How to prevent users uploading sensitive data?
A naïve approach would be to create a whitelist of websites and just block all traffic to other sides. And in an idealized scenario, this is what I would recommend you to do.
However, depending on your company and the sensitivity of the data, this may upset your employees greatly. Employees like to spend some time on Facebook, YouTube or Cool Math Games, and contrary to traditional industry wisdom, blocking those will not improve productivity.
If you feel like you can employ a whitelist that your employees are happy with, then at least you will be able to limit what a possible attacker can do.
Otherwise, you will have to do a blacklist approach, blocking content and actions you don't want your employees to consume or perform. Good sites to block would be all kinds of content sharing platforms, file upload sites, pastebin-esque sites, etc.
Of course, nothing stops an attacker from registering the domain igkjdfhgokihkaihgs7ugzh.com and just uploading the sensitive documents there.
Regardless of whether you go with a blacklist or whitelist approach, you will have to make a choice between security and usability. And we all know, security at the cost of usability will come at the cost of security.
How can I prevent users from "accidentally" publishing sensitive material?
As an example you mentioned employees creating a spreadsheet containing Social Security Numbers and uploading them to Dropbox or Google Drive.
A technical approach would be to just block those services outright, but they may have plenty of legitimate use-cases in your company. It's better to solve a people problem with people solutions.
Educate your users on what cloud services are, why it's dangerous (and illegal) to upload such data to the cloud and that it is strictly forbidden to do this for any reason.
You will likely have a document disclosure policy, classifying documents in some way. Make sure every document is labelled in accordance with this policy, and ensure that only the lowest class of documents (Public, etc.) can be shared on services like Dropbox.
It may be worth a try to offer a dropbox-like service within your company. This way, if employees need to share documents with each other (or potentially with customers), they still reside on your drives, and not on Google's.
How do I prevent a skilled attacker from exfiltrating data?
Basically, you don't. Depending on the value of your data and the patience of your attacker, there is nothing you can do to stop it.
If an attacker wanted to, they could take pictures of a document with their cellphone and then exfiltrate them that way. With the right settings, one can take ~1 picture per second. If you fit a whole page on the screen (so that the data is still readable), then you could sift through a 100 page document in under two minutes.
If you want to get even more paranoid, there are glasses with cameras built into them. They look just like regular glasses, and an attacker can take all the time in the world to record as much data as they wanted.
Depending on the nature of the data (e.g. research within your company), an exact duplicate of the data may not even be necessary. A malicious employee may simply gather information by speaking to colleagues and remembering what they said. An example can be found below:
Eve: "Hey Bob, how's it going?"
Bob: "Hey Eve, I'm good. How're you?"
Eve: "Fine too. What are you doing?"
Bob: "Just working on our new recipe for the super secret burger sauce. I think I got it now."
Eve: "Really? What's the breakthrough?"
Bob: "Simple, really. All you need to do is add some flux from the flux capacitor and people just love the taste!"
Eve: "Wow, that simple? Good thing nobody's going to find that out, eh?"
Bob: "Yeah, absolutely! Wanna go get a coffee?"
Eve: "Sure thing!"
And this is the story how Eve stole the super secret burger sauce. No high-tech, no spy gadgets, just talking to people.
In summary, install a SSL Proxy, monitor the traffic and block anything you consider malicious (easier said than done). Most importantly, educate your employees. Most of them don't want to harm you anyways, they just want to get their job done.
And as for determined attackers, your assertion that there's not that much you can do against them is right. Just don't hire people named Eve or Mallory and you should be okay.
