So, I use regex to block all Roku domains on my network via pihole:

(ads|logs|cloudservices|image|images|web|prod.mobile|wwwimg|captive|customer-feedbacks|amoeba|amoeba2|sr|giga.sb|cs).roku(.admeasurement)*.com$

Then, possibly overkill due to the above, I used OpnSense firewall rules to block all traffic from my Roku tv. I think I just got fed up with seeing Roku spam in my pihole, as the above regex seems to completely "break" Roku.

After that, I set up FLauncher (following the method #2 instructions on the gitlab page) on my shield. This makes it so I only see the Roku launcher for a few seconds while the shield starts up, and then I'm dropped straight into flauncher. I chose flauncher because it's very simple and barebones, so you might want to explore other options if you want more advanced features. I don't really need those features since I'm usually using an app anyway.

Note that I did all of that after the tv was configured and set up, YMMV if it's a brand new tv as it may need to call home to do the initial set up.