Use a DNS that has porn filtering along with any custom sites you don't want them accessing via the browser. You can even create your own MDM profile to prevent a kid from disabling the private DNS. There are sites that will set this up for you too. Furthermore, use parental controls to prevent installing apps without your permission, use the built-in features to limit screen time, and use tools offered by social media apps to limit usage. A super smart IT wizz kid may eventually figure it out but this will keep most kids from accessing inappropriate stuff.