You can use tools like Android Family Link to allowlist apps. If it's not preapproved, it's not going on the phone, period.

The tricky thing is that for this to be effective, you need block all general-purpose browsers as well, which kinda sucks.