@San4ez39 

Hi, welcome to the community.

Many software features on the Deco Mesh follow the main Deco. Deco X50-5G is capable of QOS and Parental Control.

For the satellite units, all Deco units can work with each other. Considering the WiFi specification, Deco X50(non-5G version) might be a good choice.

https://www.tp-link.com/en/compare/?typeId=5700&productIds=88439%2C52557

I noticed you also mentioned that "I will add on top another layer of DNS security with Cisco OpenDNS free account (I can limit access to some sites additionally)."

Google search told me that you might need to manually set the WAN/IPV4 DNS to be the Cisco OpenDNS. While for Deco X50-5G, it is not allowed to change the WAN DNS and would use the DNS server automatically assigned by the SIM ISP.

In this way, here is another suggestion for your reference:

NE200-outdoor+Deco X50(non-5G) Mesh

NE200-outdoor has no WiFi and supports IP Passthrough mode. It could work as a 5G bridge modem, then we can add Deco X50 Mesh behind NE200-outdoor to provide WiFi coverage around the house.

https://www.tp-link.com/en/home-networking/5g-4g-router/ne200-outdoor/

Thank you very much.

Best regards.