I’m planning to set up a separate heavily filtered kids vlan/wireless network. I’ll leave some vulnerabilities in it so if they want unfiltered internet access they have to get it themselves.