@internet-breath 

Rather then parental controls you can try using the Access Control, and deny all the service ports for that specific IP address which is the childs device.

@Tony Thanks for the tip! 

I've been playing around with access control.  I listed the child's device as a "host" and listed a couple of domains as a "target" and then tied them together into a "rule".  I can confirm I'm able to blacklist websites on the child's device without affecting the parent devices. 

But, I need the opposite configuration: to block the entire internet on the child's device (with the exception of any sites I whitelist). 

I'm coming up short.  The router admin page has a set of instructions on the rightmost column.  It says:

For example: If you desire to allow the host with MAC address 00-11-22-33-44-AA to access www.google.com only from 18:00 to 20:00 on Saturday and Sunday, and forbid other hosts in the LAN to access the Internet, you should follow the settings below:

1. Click the submenu Rule of Access Control in the left to return to the Rule List page. Select Enable Internet Access Control and choose "Allow the packets specified by any enabled access control policy to pass through the Router".

This is almost what I want to do.  The difference is I need to allow (not forbid) other hosts (I assume this means all the parent devices) to access the internet. 

Maybe an alternative approach is I could create a new "target" that somehow lists the entire internet (not just a few websites)?  Then I'd make a rule for each parent device to use this target all the time, and use the more limited "whitelist" target for the child device. 

Just not sure how to do that or if it's the best approach.  Any idea?

Thanks again!