andoff[1] works well. I use it to lock down DNS settings to nextdns to block all the sites I want.
Then I use lockmeout[2] to lock opening andoff to change the settings.
Also there is limitphone[3], but it has less settings and is easier to uninstall than andoff, but works via the same mechanism.