If you see the same MAC address, then there is a layer 3 device between you and your clients. You can't use group policies with this configuration for content filtering.
Group policies requires that [effectively] the MX be the default gateway for the clients to work. It applies group policy based on MAC address. If it can't see the client MAC address it can not apply the policies correctly.