AaronLocker VS CryptoBlocker

Check it out here https://github.com/microsoft/AaronLocker

100% this. OP, If you want to go further, checkout Aaronlocker https://github.com/microsoft/AaronLocker

As for "why would you do that??", my reasoning is that Aaronlocker exists, and so should Aaronwall (final name pending). If I can be notified when some application tries to communicate on blocked ports, I can take action by contacting the user who ran the application, and that is safer for everyone.

You could look into Aaronlocker. That is a tool which can be used to manage AppLocker installations and it's open source. https://github.com/microsoft/AaronLocker

Turn on Applocker to block all exes/scripts by default. You can use Aaronlocker to help scan for exceptions, then enable it in audit mode for a few weeks to catch anything else you need to allow (use Windows Event Forwarding if you don't have another way of collecting Windows events. It's also pretty easy to set up). I did it recently and it's been pretty painless so far. Well worth it to know users can't run some random program they downloaded or found on a USB drive.

For those familiar with CryptoBlocker (https://github.com/nexxai/CryptoBlocker) for FSRM, how do you handle updating the list of known bad extensions?

Utilize file screens via the built in windows "File server resource manager" even better if you automate the updating via this script. to prevent the ransomware's ability to modify files.