This document suggests what to configure in some typical cases, but without explaining why. If you want to understand in detail what's happening, or want to configure for a situation that isn't covered here, read How Download Managers Work.
Note there is no connection between which files can be downloaded and which files will be anti-virus scanned (except of course if a file can't be transferred at all, the question of anti-virus scanning it will never come up).
Each of the following cases shows only the basic configuration for a very simple pure case. Most real world configurations will be both extensions of these and some combination of these. Creating real world configurations, which shouldn't be too difficult, is left as an exercise for the reader.
In each dansguardianfN.conf, set blockdownloads on. List the legitimate websites that provide software updates in lists/exceptionfilesitelist. If you use both the Fancy and the Default download manager, be sure the Fancy download manager is not used for software updates. In downloadmanagers/fancy.conf, un-comment useragentregexp = '…', and be sure the value specified for it will not match any of the client programs that fetch software updates.
If some client programs that fetch software updates never succeed and evidence “timeout” problems, it may be necessary to enable the Trickle download manager also (you may need to rebuild if the option wasn't compiled), and use its useragentregexp = '…' to match only the problematic software update client programs.
In each dansguardianfN.conf, set blockdownloads on. List legitimate websites that users are allowed to download from in lists/exceptionfilesitelist.
In each dansguardianfN.conf, set blockdownloads off. List all the kinds of files for which downloads should be banned, and the extension(s) and mimetype(s) for each one. Then add those extensions to lists/bannedextensionlist and mimetypes to lists/bannedmimetypelist.
In each dansguardianfN.conf, set blockdownloads off. List all the kinds of files allowed for downloads, and the extension(s) and mimetype(s) for each one. Then add those extensions to lists/exceptionextensionlist and mimetypes to lists/exceptionmimetypelist.
In each dansguardianfN.conf, set blockdownloads off. Just use without change the default lists/bannedextensionlist, lists/exceptionextensionlist, lists/bannedmimetypelist, and lists/exceptionmimetypelist.