It’s totally doable. You want to run a VPN server on the host so that you can connect to it and have your network traffic go through it. You could tunnel all traffic thru the VPN, or only the DNS traffic. Then you could have the pihole bound to the local interface only, not accepting connections from outside that host.

I’m making it sound easier than it is, but it’s still pretty straightforward. There’s actually a doc on the official pihole site that explains how to do this but I haven’t read it completely.