The solution is to do as most goverments do [0]: sniff the SNI header during TLS handshakes and drop the connection if the domain matches your blocklist(s)//regex filters.

[0] https://signal.org/blog/looking-back-on-the-front/