Create an additional rule that blocks all other traffic.

When creating the policy, ensure that webbrowsing is included in the same rule.

Ensure that the Service column is defined as "applicationdefault" for this Security policy. Doing this will automatically include the implicit webbrowsing application dependency.

Nothing. You can depend on PANOS to block the webbrowsing traffic that is not needed for Facebook use.