I use a combo of Pihole + OpenDNS with filters. And my kid's user account does not have privileges to change network settings. Yet. Things will be enabled one by one in due time until he's in 100% control of his own computer.
And if he actually knows what a DNS server is and is digging around for the setting, and trying to hack my shit, then I'd say he's ready for the "adult" computing world.