I need to block Flash plugin by default and only allow it on manually approved sites, while allowing the PDF plugin to run anywhere automatically. Is it possible to achieve?
I use FlashBlock - does exactly what you've described.
Honestly, my knowledge of permissions in Chrome is a bit... lacking. This sounds like something that should be done in your firewall... and not at a workstation level. In most firewall appliances, it's fairly easy to block certain mime-types & such on-the-fly and white-list some sites. The advantage to this approach is that even if a user switches to IE, Opera, Firefox or whatever else to access whatever annoying flash site... they're still unable to get there.