To further clarify, it won’t be possible at all no matter what product you use, unless you install new root CA certificates on every device accessing the network. You can’t intercept HTTPS, because it’s designed to avoid that, the best you can do is block entire domains (via Ip, DNS or SNI inspection).
Blocking DNS just help to some degree. A user who knows whats going on and like to get around DNS block, can just change his DNS to point to another DNS server.
If you then block other DNS, he can make a static entry on his computer.