Hi,
I have not worked with GX family yet so all I can tell you is based in what I have seen in its product documentation. I have only seen a "block website feature" (only to block domains... in case you configure a subdomain it blocks the whole domain) and L3 firewall.
So it seems you can only work in a block-list (former black-list) not in a permit (white) list scheme.
L3 FW allows you to add permit or deny rules. However it is based in IP prefixes not in FQDNs.
I think you are right and an umbrella license would be needed for your requirements. It can be required from the GO Portal itself. Of course, not for free.
Regarding the internet destinations your GX is filtering by default: I'm not aware it could be using any kind of cloud-based content filtering.
Anyway, in order to be sure about your needs, I suggest you to ask in the Meraki Go Community. Link below (For some reason Meraki and Meraki GO do not share the same portal nor the same community)
Meraki Go Community
HTH