Maybe i made it sound weird. Use a firewall to catch all dns traffic trying to leave the network and route it the PiHole/Adguard Home. This is how to make sure nothing, not even hardcoded dns on any app on any device, wont be filtered. I personally block google dns IPs on top of this but that’s just a precaution.
You would need a firewall to provide any type of blocking or port forwarding. Most routers provide some basic ability to do this but it’s hit or miss and depends on the manufacturer. I came from a modded merlin asuswrt Asus router firmware to an opnsense firewall running on custom hardware.