[yumraj]

I have a very simple setup that works for us.

ISP’s router has unrestricted Wi-Fi access. I run a router behind it with restricted (via pi-hole) access.

All devices connect to the restricted Wi-Fi. Any time I need unrestricted access, I connect to the ISP router Wi-Fi for some time and back to the restricted when done.

[PrimeMcFly]

Don't you mean you run the restricted router in front of the ISP router?

[yumraj]

Not sure what the correct usage is regarding front vs behind.

Basically Outside World — ISP Device - internal restricted Router (using pi-hole as DNS) - home devices

So, yes, if looking from inside the restricted router would be in front.