What is everyone using in terms of ensuring church devices are content filtered even when they are off the network?
Cisco Umbrella (old OpenDNS). Works on all units and browsers, including Chromebooks. Been using it for years - highly recommend. Even use on my in-house units for simply filtration. Admin privilege prevents overrides.
Bitdefender Gravityzone Business Security. Acts as both antivirus and content filtering for both Macs and PCs. Available in Techsoup.
Use a product that installs an agent: Umbrella, DNS Filter, and WebTitan are all decent purpose built filters. There are a couple that are (somewhat) connected to an antivirus like Bitdefender Gravityzone and Webroot. Colleagues who are deep into Sophos Intercept X have said they do web based filtering even when not behind the UTM, but I wouldn’t really recommend Intercept X over Defender ATP for a church given the Defender ATP nonprofit discounts and integration with conditional access, so Umbrella if you are big (50+ staff), DNS Filter or WebTitan if you aren’t, and maybe Webroot if nothing else fits the bill are going to be your best bets.