That is what I did. I used a TP-Link Archer C7 router and installed adblock and few other useful packages. Works like a charm so far.

Do you know if it’s possible to deploy it on a virtual AP? E.g. have “MyNetwork” and “MyNetworkWithAds” - so that it is easier for nontechnical users to switch, and also doesn’t deactivate for everyone when just one user needs to (even if only for 5 mins)?

Possible but not that simple actually, as there is little to no documentation or shortcut for such a case available using dnsmasq. Afaik you can only realize this by running multiple instances.

The childproof network example is the fitting how-to you can learn from: https://forum.openwrt.org/t/kidsafe-or-guest-wifi-forced-saf...