This feature is available in Headwind MDM Enterprise (or can be purchased as an extra set of plugins).
You can assign a whitelist and a blacklist to each configuration of devices.
Setting up the URL filtering is done in two steps.
1. Configure whitelists and blacklists in Settings - URL Filtering.
The list contains a set of domain names, one domain name per line. Wildcards are available, for example, to add all subdomains of facebook.com, add *facebook.com to the list (notice: if you specify *.facebook.com, this wildcard template will include all subdomains, but not the primary domain!).
For example, you may wish to blacklist all domains, specifying * for blacklist, and whitelist only required domains / domain templates.
2. Assign a whitelist and a blacklist to the configuration requiring URL filtering by clicking Functions - URL Filtering.
By default, a blacklist for the configuration is empty, which means, all domains are enabled.
A useful feature of the URL filtering plugin is "Block ads", this will disable domains identified as the ad sources.
Notice: URL filtering plugin turns on a (local) VPN on the device, so this plugin can't be used with another VPN.