Should a firewall policy only be concerned with in-bound traffic?

No. Concerning yourself with just the outside threats is one-sided - an infected computer could join the network or a networked computer could be infected through means other than the internet itself (like inserting an infected pendrive), and that computer would then become a threat not just to the network behind the firewall, but also the Internet at large.

Monitoring inbound traffic is a way to stop incoming infections, but a firewall should be configured to catch threats inside (and outbound) as well, in order to help stop the infection from spreading when it's already "in".