For much greater control, configure the laptops to use OpenDNS as their DNS servers.
Anything that relies on configuration on the laptops will of course be subverted by any teenagers who are sufficiently not-lazy that they can be bothered to do it.
My kids know that in theory I can look at the router logs to see what they've been doing, and that in theory I can block their internet access. In practice the only time I ever have completely disconnected them was when they allowed viruses into my network ... which hasn't happened for many years now.