My policy is all child devices are blocked from internet access in the firewall except during specific times when I unblock it and am actively looking over their shoulder. Otherwise, it’s curated content on Jellyfin, including a library of downloaded videos from YouTube as well as other self-hosted stuff.

If a game or app requires internet access, too bad. I won’t even play games on my own devices that require a connection for that matter.

I have considered setting up a proxy server for my older child with specific domains allowlisted.