Blocking domain for group of users/or devices

you can do that easily with GSA and you control the ‘who’ by Conditional Access

you can also do that by MCAS and/or indicators of compromise (url) - basically Smart Screen - but that is extremely cumbersome, you have to select devices (and that weird concept that device can only belong to single device group) and not users, and slow to apply - minutes to hours, sometimes applies inconsistently - thats your second option