How would it work to block some addresses and not others though? Only way I can think of is to block all DoH traffic, and hope it falls back to conventional DNS, and then selectively block that. If there is no fallback, you might as well disconnect it from the internet, the effect will be the same.
