Selfhosted

Just so you know, you can run pi-hole as a container as well

About dhcp, I don't know about unifi, but I guess in the firewall you can configure static dhcp leases. So son1 devices always get same ip. Then you can configure a hairpin port forwarding, so any requests for ports tcp/udp53 from his devices get forwarded to pi-hole. That is assuming that in the "general" dhcp config you assign an external dns.

Otherwise you could try creating two different dhcp pools, one with pi-hole (and make sure son1 devices get a static lease in there) and one for everyone else.

As a side note, I recommend looking into self hosting your piped instance, so even son2 can enjoy YouTube without all the ads! (And the tracking)

Just create a dhcp reservation in unifi.

I set up separate VLANs for devices that do or don't get filtering with different DNS servers assigned. And I have two different wifi SIDs on my access point for the different VLANs as well as having ports on my primary switch aligned to one or the other VLAN. I did end up having one other switch that has devices from both VLANs in a different area and had to set up one port on the primary switch with a couple of MAC-based filters for assigning the VLAN for just devices on that remote switch, but those are static devices, so that wasn't an issue. I don't attach any other devices to that.

Pihole can set up "groups" for different blocklists. You specify client by IP or MAC address so it doesnt matter what the dhcp server is, so long as there's a static IP or static MAC address. My pihole server doesn't have dhcp set up and I'm able to do this fine

Though from personal experience this just becomes a game of cat and mouse, and if you have a motivated teenager then they will find a way to circumvent this. For example android can rotate MAC addresses, and IP addresses are trivial to spoof as well.

I run AdGuard as an addon to Home Assistant. If you want to stick to AdGuard you can go to Settings > Client Settings and set a per-client filtering rule. There is a tab in the client settings that can be used to filter specific services with a click. Setting an IP reservation for your child's device in the DHCP settings of Unifi or your router will help ensure the IP address stays consistent.

For the PiHole option, you don't actually have to let the PiHole handle DHCP. You just need to tell your DHCP server what DNS server to use. For example, my router is .1 and my Raspberry PI is .2. The DHCP server, my router, tells all devices .1 is the gateway and .2 is the DNS server. You may also need to set these settings on the individual devices to prevent them from ignoring your DNS settings, but that can be done from the network settings. Avast had some safe networking "feature" that would force my DNS settings to be ignored, same with my Android phone.

Of course, the downside to all of this is that any different device, different IP, device from a friend, or mobile data could bypass these restrictions. You may soon be in an arms race with your child and chances are they can get more clever that you can in a shorter time frame.

I am definitely not the best at networking, but can't you do that through your current dhcp client?

Parental controls on YouTube work decent.

Don't do this at a network level. Do it on the device

Adguard Home can do per-client filtering, if you go to Settings > Client Settings, then add a client and you can choose all the options.

No need for DHCP on Adguard to be enabled to do that.

You can also just block YouTube in your unifi firewall/router for that one client.

You don't need DHCP, you can just use DNS and then set up different blocking groups based on the device.

The problem with this solution is that is it opt in. You would need to change all the wifi settings on each device separately to point to Pi-Hole as the DNS. This is something that could easily be disabled as a 12 year old would probably be able to figure out how to change the settings on their mobile devices or computer with a Google search.

Pretty sure you can unblock per device in Adguard, so maybe block it first then unblock from the logs for the clients you want to allow?