Hello,
First off all this this forum for Brightmail Gateway,i think forum moderators move this to under SWG forums.
Anyway,
1-SWG can block attacks from internet to servers and from servers to internet but SWG is not an IPS appliance,so it's better use an IPS in front of your web servers.
2-SWG have great antivirus engine (Symantec Scan Engine) to protect your networks from malware,so yes it can block.
3-As i said in first , SWG can scan traffic both inbound and outbound.
For a best practice to secure your web servers. Deploy a firewall and ips in front of your web servers,install symantec endpoint protection with IPS module and fine tune some signatures to prevent false positives.
Regards,
Oykun