Hi,
You can disable facebook and many other SN sites by using App control

Firewall...App Control
1. enable Application control
2. Add...Group/Any...Application List
Check On for disabling access to whatever you want

AFAIK, it is not possible to block a string in an URL because the URL is already encrypted when being sent to the server. See http://stackoverflow.com/questions/499591/are-https-urls-encrypted

As others suggest, you may only block all IPs of known Facebook servers. You'll have to update that list on a regular basis and might want to include things lke Cloudflare's IPs - which is a sure way to shoot yourself in the foot because all kinds of other services can be behind a Cloudflare IP. And then there is IPv6...

If your users are not particular tech savvy, you could try to add a "wrong" DNS entry for facebook.com and try to force users to only use your DNS servers...