@Malfa The best and easiest way to prevent the captive browser from being displayed is to enable Parental Controls on the device. This prevents the user from editing their settings, and so they cannot enter the DNS to configure it in the first place.
For the Switch, this can be done in Settings. You don't actually need to block any ESRB content, just having parental controls enabled is enough to block access. A PIN will be prompted for when they go to change the DNS settings.
If you're tech-savvy, blocking all three of our DNS IP addresses at your router's configuration page will also fully block them from resolving DNS requests:
45.55.142.122
45.55.112.11
46.101.65.164
I can also recommend: 1.1.1.1 for families, which can be used to allow or disallow categories of websites, even across other devices on your network. It's a good way to filter all Internet requests without having to set up extra hardware. More info here: https://one.one.one.one/family/