They don't get unsupervised internet access, there's always a supervising adult in between the child and the internet. For the child's devices it's the parent who has access to parental control software which will restrict access no matter where the device is, at the school it's the school, at the library it's the library, and for the friend's device it's that friend's parents. The answer for what pages do you block is that you use a service who does the work of categorizing pages for you. Every parental control software worth their salt will have this. It's basically the entire value proposition of paid filter software.

No matter the enforcement mechanism there is no way to defeat the "Shawn's parents are cool" problem because Shawn's parents will just give him their IDs to verify. And I know this because I'm for sure going to be that parent.