I'd be fine with hardcoded DNS if the devices would fail back to DHCP provided DNS. Then I can just block certain destination IP address. But a NAT redirect is working fine for now.