I though Pihole could act as a "whitelist-only" DNS server but maybe I'm wrong, that could be an additional layer.