Hello there!
As the Graph API is a RESTful API using HTTPS calls, there will technically be a unique URL for each call. However, assuming you want to use v1.0 of the API, all URLs will start with "https://graph.microsoft.com/v1.0/*".
You could whitelist "https://graph.microsoft.com/*" to allow for use of different versions of the API.
For authentication purposes, you will also need to allow calls to "https://login.microsoftonline.com/<YOURORGNAME>.onmicrosoft.com/*"
Hope this helps!
Martin