For companies with ISO-27001, Web Filtering is a control recently introduced. Protective DNS can tick few boxes and genuinely keep your network a little bit more secure (and ad free).

As an employee I'd be against it, but company device so what can you do. As the one managing the security and ISO process, it made my life a lot easier from both auditing and "why is my computer acting funny lately" perspectives. Showing my own user account having triggered an ad-based block, and the company-wide malware block rate was enough to satisfy the auditor that we has appropriate controls in place for a small company and move on to the next item.

Provided you take the stance of everyone is trusted to do their jobs, so we only need to block ads, piracy and malware lists and don't retain logging except where a block has occurred for auditing, I think it strikes a reasonable middle ground.