An easy approach is to use DNS. There are several DNS servers to choose from. You just set the DNS server for your LAN.

For my kids VLAN i use Cloudflare 1.1.1.3 which will block malware and adult sites.

https://blog.cloudflare.com/introducing-1-1-1-1-for-families/

@JSDamgaard Thanks, I hadn't considered that, I'll give it a try.  Much appeciated!

@flyjar 

Under Wired Networks and LAN, I selected the VLAN I wanted to modify.  (e.g. Kids VLAN)

I switched DNS server from automatic to manual and 1.1.1.3 and 1.0.0.3.

I will battle test it tonight to see if it works.  From their blog it says to use the following:

Malware Blocking Only
Primary DNS: 1.1.1.2
Secondary DNS: 1.0.0.2

Malware and Adult Content
Primary DNS: 1.1.1.3
Secondary DNS: 1.0.0.3

@flyjar under SiteSettings/WiredNetworks/LAN where you configure your LAN's. For a specific LAN, there is a DNS Server option Auto or Manual. If you set it to Manual you can specific a primary and a secondary DNS server for the specific LAN. You can also specify DNS servers under WAN advanced settings. These will be used for a LAN in Auto mode.