Q: Do firewall rules have to be symmetric?
Short and simple answer: No, they don't HAVE to be. But it doesn't mean that they CAN'T be.
It depends on the traffic that is expected to pass through the firewall, but most of the time the rules won't be symmetric.
For example, if you don't have a DNS server inside your network, you will probably block incoming DNS traffic, but if you block outbound DNS traffic, you won't be able to access anything that uses domain names. From web sites to ftp servers, ssh servers, your backup account in the cloud, etc.
But it makes sense if you don't want employees accessing anything that is not in your internal network. Obviously, there are ways to bypass that (to memorize the server ip address...), but it will definitely make things harder for them.
So, symmetric rules might break things for you. But maybe that is exactly what you wanna do.