Enabling the AUTO-block sites that attempt to connect option in a deny policy configures the system to automatically block sites that violate the policy, thus adding the host to the blocked sites list. Using the Firebox System Manager's Blocked Sites tab to add a site manually places the host on the temporary blocked sites list. Meanwhile, selecting Setup > Default Threat Protection > Blocked Sites in Policy Manager and clicking Add allows you to add sites to the permanent blocked sites list. Adding a site to the Blocked Sites Exceptions list would actually whitelist the site, not block it.