I can run app based routing and blocking on my router, but whether that would restrict DNS for those services I don’t know.

That’s the double-edged sword of DNS over https. It allows us to hide our DNS queries from local ISP and others, but it also allows applications to hide theirs also. It just looks like encrypted web traffic to your router.