It’s too hard on the Unifi line, but Ubiquiti Edgerouters allow some neat rules. Eg if on port 53 and not coming from the Pihole, send back to Pihole.

The Samsung was very chatty, but didn’t connect to an unsecured wifi network I had setup for testing.

It’s gone now and an equally chatty Sony is in its place - with not network access.