That's an interesting problem. Even if you have full control over your children's devices they can still simply toggle the DoH feature back on unless you do complicated enterprise style device management things.

However DoH isn't obfuscated and in order to operate the list of resolvers that firefox uses must be published somewhere. It follows that you should be able to filter the major DoH providers at your gateway.