Ideally you'd use both. Something like a pihole to serve as a first wall of defense for the entire network, and then additional things like uBlock Origin for any device with a browser that supports it, for some more granular control.

This is how I keep my home setup.

The pihole has a fairly loose blocking setup because some people in the house need access to things that would normally get blocked and I'm not spending weeks unblocking specific things until everyone is happy.

Behind the pihole everyone has their own suite of browser extensions and software to block what they would like at a much more personal level.

You are able to force devices to use a specified DNS. even when they have hard coded DNS in them. Your router/firewall must be able to support redirection of network traffic though.

A. Device part of a business infrastructure:
Just don't change anything; those policy are there for a reason!

B. Consumer device:
1/ If we're talking about proprietary hardware/software forcing your network to use a specific DNS, then you need to provide more details because you should be able to change it.

2/ There is also the case for a malware:
A fresh start is preferable.
Disinfect the system while offline, then back up the needed files.
Reinstall the system on a new/old formatted drive.
With the exception of taking your privacy/security seriously this time.

Sounds like you shouldn't use those devices. I go for custom software personally so I can control the device itself

On Android, DuckDuckGo provide an app called App Tracking Protection which blocks everything trying to track you/phone home via the apps you've got installed. Drawbacks are you that you can't run a VPN client at the same time.

NextDNS is in the cloud, the cloud is just someone elses computer. You have to trust it really hard.

It's the exact same how I use it. Imo this is the best solution.

How does it compare to NextDNS? i've never heard of it but it looks good!

There shouldn’t be any reason you can’t change the DNS setting on your devices though, right? You’re not required to use your router for DNS.

I disabled DHCP on the ISP router and my rsspberry pi with Pihole is the DHCP server now, serving it's own IP address as DNS for all devices.

dual nat setup is probably something you should look at

Depends on your needs. The problems with DNS servers from ProtonVPN, Mullvad and so on is that they use their own filter rules and you can't castumize them to your needs. You can probably go much stricter with what you want to block if you use a DNS based adblocker where you can manage your own filter rules.