Don't you control the client devices? What's stopping you from disabling DoH? If you use your own DNS servers, they can just use DoH in the background. There is much less threat using unencrypted protocols on your own encrypted network.