In fact, yet another of iOS 9's features is a custom VPN protocol API, so you could probably do this purely client side as a "VPN" that just connects directly but blocks certain hosts.

Disclaimer: There may be reasons this wouldn't work, technical or approval-wise, that I'm not aware of.