traal > Easy solution for you is to run two routers on your network! I have the same issue! My main router is locked down so that all port 53 traffic is forced to go to OPENDNS that way all the computers laptops smartphones tablets, etc. all point to OPENDNS no matter what my kids set their local DNS too. (Yes they have learned to live with me. I have done this at work too!) OPENDNS is great for blocking sites that are not, should we say, family safe - they use to have much better blocking abilities but they dropped using iPrism (great internet filter BTW) a few years ago. Anyway, so I want all my network machines running OPENDNS but not my ROKUs!
So what I have done is put a second wireless router (use different SSID and radio channel than the first router) in front of my first wireless router - now I know you may say I am running NAT behind NAT but it all works fine. You set up the second router with a different subnet with all the WiFi info you want - make it secure - and use the WiFi on this second router only for your ROKUs nothing else. Do setup DHCP (Roku needs that) and do not lock down port 53 on this second router and setup one of the LAN ports to be a DMZ and plug your first router into that port and assign it a static IP address on the WAN port of the first router (best to not use DHCP on the WAN port of your first router for this.) Don't forget you are now running two separate subnets (should be something like A=192.168.0.1/24 B=192.168.1.1/24 Your first router WAN port would be set to static IP on the B subnet say for example 192.168.1.2/24 and this would also be the DMZ port on the B router) all your home stuf will be on A and all ROKUs on B. You will have to watch your second router that the kids do not figure out to plug in a CAT5 cable and run on that but I set MAC filtering to only allow the ROKUs to work. (Yes I know about MAC spoofing but in reality it is too much trouble to implement so in a case like this it works fine.) So if you have a second router - definitely worth a shot to try it out. (Both routers should be able to handle WMM!)