Hi Rob,
You can check the the Administrator's Guide for SBG where we explain the file format that you can use to import good/bad sender lists.
The administration guide can be found at:
http://www.symantec.com/business/support/index?page=content&id=DOC3017
Pages, 165, 166 is where you want to look at.
I would also recommend implementing the SBG without the whitelist and maybe let it run for a week or so and see if you really need it, a lot of times we recommend starting with a clean configuration so for example, if you had a lot of manual rules from another product they might not even need to be migrated to SBG and manual rules and lists will only add overhead to the product.
I hope this helps.
Thank you,
Marco Bicca