Generally, most data exfil uses HTTPS with the standard 443 port. Blocking 'exotic' ports will not likely help but increase your support calls.

If you do want to filter uncommon ports, don't forget to establish an easy procedure to allow users to have required ports added to the whitelist, even temporarily.

How are you planning to distinguish data exfil via Wetransfer, Dropbox, ... from legitimate use?

Is blacklisting ports(blocking unused ports) better or whitelisting(only allowing outbound traffic from ports) better?

Best practice is to permit/whitelist known traffic and block everything else.

How can I ensure the ACL is not too long which can impact router/firewall performance? Is there a way to reduce ACL length?

This can get tricky. If you need granular control you might need to shorten/optimize ACLs in regular intervalls. If they are kept well-structured that should be manageable.

Any other suggestions on how to do this to prevent data exfiltration would be helpful.

A good firewall with decent DLP features, SSL deep inspection and granular application awareness will make the task much simpler and likely more successful than simple port-based filtering. However, DLP needs to start at each client - controlling and managing applications and ports, containing threats and infections. The firewall can only be one piece of your total strategy.

Generally, most data exfil uses HTTPS with the standard 443 port. Blocking 'exotic' ports will not likely help but increase your support calls.

If you do want to filter uncommon ports, don't forget to establish an easy procedure to allow users to have required ports added to the whitelist, even temporarily.

How are you planning to distinguish data exfil via Wetransfer, Dropbox, ... from legitimate use?

Is blacklisting ports(blocking unused ports) better or whitelisting(only allowing outbound traffic from ports) better?

Best practice is to permit/whitelist known traffic and block everything else.

How can I ensure the ACL is not too long which can impact router/firewall performance? Is there a way to reduce ACL length?

This can get tricky. If you need granular control you might need to shorten/optimize ACLs in regular intervalls. If they are kept well-structured that should be manageable.

Any other suggestions on how to do this to prevent data exfiltration would be helpful.

A good firewall with decent DLP features, SSL deep inspection, granular application awareness and user authentication will make the task much simpler and likely more successful than simple port-based filtering. However, DLP needs to start at each client - controlling and managing applications and ports, containing threats and infections. The firewall can only be one piece of your total strategy.