Unmanaged SEP Firewall with NTP - how to block DNS subnets?

How can one block incoming &/ outgoing trafic to certain DNS domains (eg. *.facebook.com) with an unmanaged SEP with NTP enabled?

I have tried using Firewall rules - but "NTP" --> "Configure Firewall Rules" --> "Add" --> Sheet: "Hosts" --> give only options:
- MAC
- IPv4 / IPv6 addresses
- IPv4 / IPv6 Subnet
For remote host filtering

So question is how do I configure an DNS subnet filtering rule? - I would assume it ought to be done to the firewall rule sets, or?

NOTE: Operating system is Windows 10 Home & SEP v12.1.6