> if it is using HTTPS for DNS resolution, I don’t know how you would block that

By filtering traffic sent from that particular device based on a query to your DNS filter to approve or deny the destination address. (Some implementation work probably required.)