I had the same problem, browser extensions weren't enough, and I wanted something system-wide.
So I built Sinkzone [1], a DNS tool that blocks everything unless allowlisted.
It’s open-source and works across OSs. Thought it might be helpful if you're looking beyond NextDNS.
I'm not familiar with this project, just checked their GitHub Readme and if I understand correctly they block what you want them to block. Sinkzone does the opposite, it allows what you want to allow, and blocks everything else.
You can configure your upstream resolvers in the config, so I think Sinkzone can be placed in front of your VPN's resolver. I never tested this to be honest.
Hey Eszpee, Thanks for checking Sinkzone out. I'm thinking about building custom schedules in the next iteration, that would support some basic pomodoro style scheduling for sure.
[1] https://github.com/berbyte/sinkzone