try hosting your own dnscrypt-proxy in combination with https://github.com/notracking/hosts-blocklists. That will turn off most trackers on your entire network.

Some MS apps will explode if they can't send telemetry. I tried it with MS Teams and it just kept bloating memory until it had to be killed. A mitmproxy config worked there to fake a 200 response to the telemetry endpoint and keep memory down.