The reason you are being asked for an IP address for the LAN/WAN port is because you have chosen to use the "Proxy/Inline" mode. One of the pre-requisites for enabling any of the Proxy modes is that you enable the "Separate Management and Inline Networks" option, and the pre-requisites of this option is that they reside on different subnets (which is most likely why it's rejecting your attempted config).
If all you want to do is block web pages, then either the "Proxy only" or the "Span/Tap" operating modes will do the trick for you (note that while "Span/Tap" mode can block web sites/pages from loading, it can't block actual files from being downloaded). I'd personally avoid either of the "Inline" modes in a VM implementation of SWG.
For any VM implementation of the SWG you will need at least one additional dedicated physical NIC (more if you want to use one of the "Inline" modes). If you don't have a spare unused NIC on your VM Host machine then you'll need to go obtain one
As far the configuration for each mode goes, the "Span/Tap" mode is (I find) the easier of the two, but does require a managed switch and your network admins' help normally. The "Proxy Only" mode requires IP addresses on different subnets and configuring browsers to point at the SWG's WAN/LAN port's address (which is acting at the proxy server).
The details of the config are in the Implementation Guide, but the above info will hopefully give you an idea of how it fits in, and how I believe you'd most easily accomplish your task of blocking webites.
As an aside, you may wish to contact Symantec for referral to a Partner (such as ourselves) who may be able to aid you in setting the SWG up.