I can’t think of a way to prevent this Mac if it has internet from booting to internet recovery or local recovery to avoid the blocks you’ve planned.
Apple’s security perimeter is to prevent Apple Silicon Mac’s from being re-activated if locked and prevent access to encrypted contents.
They aren’t designed to lock anyone in possession of a Mac out of the internet with safari for recovery OS operations on “locked down” hardware.
You’ll likely have to enhance your network filtering at home or substitute older hardware that allows a firmware lock.
DNS blocks are able to add some resistance, but a motivated person can get around them in most cases. Good luck with managing this parenting dilemma. Your most effective measures will be non technical and based on your child’s age, of limited success as they gain access to friends and other devices outside your control.
