Re: nested application

Yes. it can be done:

http://www.juniper.net/documentation/en_US/junos12.1x44/topics/example/application-firewall-application-group-configuring.html

You would still need to see the details of the applications and the nested applications so you can determine what you want to block.

Configured under 

edit security application-firewall

create rule-sets and rule to match dynamic application  BlockYoutube-Apps<===rule-set

decide if using whitelist/blacklis

Apply the rule set within a security policy for e.g.

edit security policies from-zone trust to-zone untrust

then {

        permit {

            application-services {

                application-firewall {

                    rule-set block BlockYoutube-Apps;