Mikrotik RB3011. How to disable mobile device updates (iOS, Android)?

Question

Mikrotik

All the best!
The task is to prohibit employee gadgets (iOS, Android) from updating software via office Wi-Fi.
The topology is as follows:
1. Mikrotik RB3011
2. "Wi-Fi Server". This is a machine with WinSRV2008R2 on board, distributing DHCP in a range different from the local network on UniFi plates
3. Employees, or rather their gadgets, accessing the network through UniFi plates.
What do you advise?
Thank you!

Answer 1

You can add domains to L7 (listed below) and get a list of IPs that are then blocked by a rule in the firewall or explicitly set in DNS to block requests to servers.
Google domains: play.google.com and android.clients.google.com Apple
domains: itunes.apple.com

Answer 2

It is possible on Mikrotik to prohibit resolving the dns of the app and google store for a specific sheet. head-on solution

Answer 3

And you can add mobile devices to your address list when issuing a DHCP lease and then cut access as you like without harming other devices. I did this on the guest Wi-Fi, so that all sorts of visitors would not heavily load the network. In the same place, you can cut traffic by volume from one poppy so that managers do not sit on the Internet from their mobile phones, squandering a channel for visitors