So that eliminates just setting their DNS to an ad blocking one in their Wi-Fi settings.

You can setup DNS ad blocking in the DNS settings, not the wi-fi settings, so it will follow you everywhere. I believe the setting is called "Private DNS" and it works great for me with the free AdGuard DNS. There is a setting to turn it on and off in there too.

You won't find any ad blockers in the Play Store. The best you can do is a browser with built-in ad blocking or an extension.

Otherwise if you want an app, you'd have to sideload it.

Rethink DNS

• https://play.google.com/store/apps/details?id=com.celzero.bravedns
• https://github.com/celzero/rethink-app

It's not free or available on the play store but I've used Adguard for Android for years and it's fantastic. Fire up a VPN endpoint somewhere like Romania and buy a lifetime license for $12 or something and you're good to go. If you want it to work everywhere system wide you'll need magisk and the "Adguard certificate" module that moves the signing cert into the system store, otherwise you won't be able to block ads in Chrome or any other app that uses HTTPS. Any app that creates a VPN to MitM HTTPS traffic will need a system store cert so that's not just an Adguard problem.

I'm pretty sure you can use Adguard to just do VPN+DNS filtering if you don't want to mess with HTTPS traffic but I've always used HTTPS filtering on my devices.

You get some number of days in unlocked trial mode too, so you won't have to pay immediately if you just want to demo functionality.

Rethink DNS is solid.

personalDNSfilter

Consider making a pi-hole for home network DNS filtering.

Set up a VPN with a pihole at home and configure their devices to use it.

I am currently using NetGuard and am quite happy with it.

The first thing I do when I download an app is to kill it's wifi and mobile data access before launching it the first time. Makes some games actually payable.