The Spotify web site is blocked in policy, but the music player is still able to stream music.
The Spotify music player uses port 4070 by default. If it is unable to connect on that port, it will roll to port 443, then port 80.
Spotify can also detect proxy settings.
In order to block the player, add the above IP address range to the blocked IP addresses in the VPM rule.
You can also add ap.spotify.com as a blocked URL or domain in the VPM rule.
Install the following CPL statement if failed: