I'd look into setting up a private DNS (eg. NextDNS) on Admin profile, blocking all TLDs (takes a while but it works and blocking child profile from installing apps.
Every once in a while log into Admin to update apps and system, and warn kid not to let phone die as unlocking the phone after reboot requires Admin password.
Works perfectly.
PS. the reason I don't recommend blocking sites using blocklists or one-by-one is that they'll always find some site they can access, some site a friend recommends for example.