@Momma786 

What you are looking for is an ACL/Whitelist.  Unfortunately, that is not currently in the feature set of the Deco Product line / Deco app.   What is the crux of this concern is that Apple and Android a little while ago added a feature, that they thought was providing additional security. This is the private Wi-Fi address.  Which like a VPN masks the true device address while online.  The problem is that address is what is used by parental controls to recognize a device and apply the filters and controls to.  When you privatize this address the parental controls as you have seen are broken.  I looked it up and have found no way to permanently disable it either.  Sure it can be toggled off but a smart kid will know where to go to turn it back on.  Sort of taking the devices away there isn't much that can be done with Deco at this time.  

One thing you can try is under options there is a 'Connection Alerts' and you can set it to push notifications every time a new device is found.  If you don't recognize this device then you can block it and it will lose access.  I will add this to our list of requests we send up every month to the design team.