I want to share my WiFi with many people. Now I already set up separate VLAN (aka guest network).
Now I need to do following only on guest network:
Can you help me with this?
You can’t.
You can’t.
The reason for both is the same: Modern systems/browsers use DoH.
When DNS-over-HTTPS (DoH) is used, DNS queries are encrypted and sent over HTTPS connections, which themselves are also encrypted. HTTPS encryption ensures that data transmitted between a web server and a browser remains confidential and secure from interception.
Because the DNS requests are wrapped in HTTPS, they appear to network devices just like any other HTTPS traffic. This means that without decrypting the HTTPS traffic—something that involves intercepting and potentially compromising the secure connection—it’s impossible to distinguish these encrypted DNS requests from regular HTTPS traffic. Network administrators cannot see the content of these requests, nor the responses, and therefore cannot block or filter them based on the requested domains.
–
You can try to make it harder to reach 18+ content or VPNs, but there is no method to disable it completely.
For now I enabled family DNS but it seems not really good as it affects search too.
What if I will ban everything except 433 port?
Then nothing will work anymore because HTTPS is 443 
But no, this will not help. You should always have enabled TCP/80 and TCP/443
OOPS 
If I will block anything else will this block VPN etc?
Not really. It will block OpenVPN and WireGuard by default - but as soon as someone uses an VPN service running on 80 or 443 it will not get blocked.
I think you need to make another dns server like adguard home on Pi4. Then put manual DNS server IP address for guest network. 
You cannot prevent someone from using frequently not blocked ports for purposes like VPN. Keeping only TCP/80 and TCP/443 will prevent Wireguard as that can only use UDP, so that will not work. However OpenVPN will happily use TCP/443.
Keeping only TCP/80 and TCP/443 might also cause some issues. DHCP traffic and DNS traffic (at least to your router) should also be possible. Do not forget that when setting up those firewall rules.
And maybe someone might want to access their own mail from that guest network? (2FA mails maybe?) That would mean opening ports TCP/993, TCP/587, TCP/995, and technically a few more, but this will handle the most default secure mail setups.
I guess on this forum, not matter what you allow, somehow some way someone can get their VPN/tunnel started. Something basic as allowing normal DNS request will have someone on this forum show off their epic IoD (IP over DNS) setup allowing them to use DNS to tunnel to their VPN server… (Yes, you can really do that!)
At the same time the users might actually want to do legitimately do slightly more than surfing the web.
You will have to find and balance. Depending on your users might even end up in a cat and mouse game!