I'm using a Deco M9 Plus system. 

Can someone explain how Parental Controls work?  It looks like my DNS servers point to those provided by my ISP.  I wondered if the Parental Controls rules were managed through TP-Link's own DNS service, but that doesn't seem to be the case, right?

I want to add some extra security and control, but I don't want to create conflicts or hamstring the control that comes with my Deco router.  If I change my DNS to a 3rd party like that provided by Cleanbrowsing.org, will those restrictions be primary to Deco's P.C. or secondary?  Or am I thinking about this all wrong?

(Clean Browsing claims to be able to enforce Google Safe Search over the whole network, which is appealing to me.)