We also deploy a browser extension via GPO/Intune to catch those and protect endpoints when they are off net.

I actually wasn’t in favor of that but the rest of team was so after risk assessing it, we determined that trusting a vendor with the permission to rewrite webpages was less of a risk than drive-by malware or phishing/redirection from a malicious ad