I wouldn't think so. I would also assume that direct DNS requests to external servers aren't allowed in the firewall. But even if they are, they probably can't use a non-company DNS server if he needs to reach internally hosted services. So it would at least require using different browser for internal and external browsing, assuming DNS requests to external servers really are allowed.

Great. Now you can be responsible for why group policies arent applying and the user is not able to access drive shares.

Firefox supports DNS over HTTPS. Enabling it will bypass the operating systems DNS. You can set a custom server that has ad blocking.

No company that doesn't allow you to install browser add-ons will allow you to run a pi-hole instance. Not on your machine, and much less as an actual pi plugged into their network. If you did plug an actual pi into the network it would probably reason to be just straight up fired.