What do you use that allows you to set per app rules?

Your solution isn’t going to hurt anything. It might be overkill, but it will definitely work.

Ultimately, I think you only really need 2 of the solutions you mentioned.

1. A network wide DNS blocker, such as Pi-hole, to catch the majority of ads.
2. A browser ad blocker, such as uBlock Origin, for the rest.

Whoever is cheapest, with good coverage in my area.

I don’t particularly think any one carrier will have any privacy advantage over another.