OK, find the solution myself!
Without proxy, Endian will use the classic firewall rules. So I have to remove port 80 and 443 from Firewall allow rules.
The down side of this configuration is that without proxy setup on browser, the navigation will be denied at all without asking for password.