Kerio Control 8.4 adds some interesting features. The first is the ability to filter https traffic, which obviously can only be done by the firewall effectively proxying your https requests and presenting its SSL certificate to the other site. As that isn't going to always work, Control also lets you exclude specific sites and specific internal users from https filtering. See Filtering HTTPS connections at Kerio's KB site.
IPV6 can now be specified as the target of a traffic rule, which means that a rule can be specific to that traffic.
The last feature is the Guest Network. The typical use for this would be guest wifi. Interfaces labeled as Guest have a special feature in that users there are not counted toward licenses. That means that the Guest Network could also be used to wire a classroom, lunchroom or whatever. Guest users do not pass through the Kerio Web Filter, but are otherwise fully secured. See Configuring guest network.
It's easy to try out Kerio Control by downloading a free trial. I also have the hardware appliance version available for demo trial if that would better suit your needs.