Yeah, could also have two Pi-Hole instances. One is network wide and block ads for everyone, and the other is the DNS the kids PCs use, set with a white list of approved sites only. You can set Pi-hole to block everything (set * as the a RegEx filter) and then add domains to the white list to be allowed through.

Groups is probably more efficient but two instances could be offer more options/nuance on how you run things.