You say you want an app but I think it would be wise to do it at the DNS level, then figure out if you need a special app to use the DNS server you configure.

I use Blocky on a VPS with countless denylists: I’ve even caught it blocking a phishing domain I received in an email just under an hour after receiving it.