You will find everything you need on this page. h_t_t_p_s://woshub.com/block-domains-websites-windows-firewall-powershell/ Policy templates for Firefox h_t_t_p_s://github.com/mozilla/policy-templates/releases
It's the same situation on Windows 10 22H2. DNS service is an integral part of the network stack and can't be disabled. I got around it by reducing the cache to absolute 0 but I have no idea how effective my tweak was or even if Windows accept 0 as legitimate config value.
Yes, you can. But I prefer to convert "hosts" domainIP to IP and add it to the firewall rule for a specific app. For that, I use the MVPS HOSTS file (with over 20.000 IPs blocked, rule for each browser separately), that's more than enough for everyone. Why so? You don't choke the Net flow.