What makes Superfish, and similar products (all herein just referred to as "Superfish"), different from corporate MitM is that Superfish is doing the MitM on the client machine. Corporate MitM is performed on a separate server or appliance.
This is important because the system performing the MitM must have the private key of a Trusted Root CA in order to work. (Strictly speaking, the Root CA doesn't need to be trusted. But the user will see red flags if it's not.)
For Superfish, that means the key has to be on the client device - one which is notoriously not well-maintained and generally very vulnerable to attacks.
For corporate MitMs, the key is on the monitoring server - typically maintained by experienced personnel who perform regular maintenance and do not do things (e.g.: web browsing, downloading extra software, opening documents, etc.) that would expose the system to unnecessary risk.
However, all SSL proxies (corporate or otherwise) still need to be carefully implemented to account for the fact that they are removing the client's ability to self-validate the remote system's certificate. Particularly this means:
- The SSL proxy must properly validate the remote systems' certificates and either appropriately warn the user or drop the connection entirely when something is amiss. As Charles Duffy mentioned in the comments, properly validating certificates also requires that the proxy does not trust its own built-in CA.
- Ideally, the SSL proxy should also do some integrity verification against historical or community-aggregated reference certificates. This is implemented in some web browser extensions, and under normal circumstances can be manually performed by the user, to help detect fraudulent use of otherwise-trustworty Root CAs. Since the SSL proxy removes the user's ability to do this themselves, or to effectively use a browser extension for this purpose, it would be best if the proxy could do its own checking to compensate. (Though I doubt this is available in most corporate MitM products.)
Another thing you need to be careful about, since you mentioned that this service is provided to you by an outside vendor, is that the SSL proxy can see all of your users' traffic as if it was unencrypted. (That's the very purpose of an SSL proxy.) This means that data you would otherwise want to have protected from third-party viewers is going to be fully visible by the vendor should they choose to abuse your trust.