Disabled DNS from settings

If you use it on your router and enable Block Bypass Methods it should block other DNS services apps etc. You could also enable it on the browser but they can also turn it off.

A more extreme approach would he that you can use a different user account or managed account with less permissions to edit things.

Either way, when I was in Middle school we had iBoss, a security system for our school tablets, I bypassed it countless times and they finally enabled a hardware measure on Knox to stop it, at some point it's nearly impossible to stop someone who has the intent to get rid of something.