Small world. I put something up a few hours ago that sits right next to this.
It is a LuCI frontend for netifyd, the nDPI agent that is already in the feeds
and still builds on current kernels. Per application and per device, live and
for the past hour.
It does not block, so it is not what you are after. But it will tell you what
nDPI can actually put a name to on your own network, which you want to know
before you build enforcement on top of it. Services it does not know can be
added.