Parental Controls always asks permission when browsing websites
You can do this with your hosts file, if you are comfortable using terminal

Manually


Open Terminal
Type sudo nano /etc/hosts then hit return
Tap the down arrow to move your cursor below the line that says 127.0.0.1 localhost
Type in 127.0.0.1 and then the address of the site you want to block, making sure to keep a space between the numbers and the address. For example, 127.0.0.1 facebook.com will block Facebook, or 127.0.0.1 google.ca. 
You must do this for any name it may resolve to, for example, if it was google, you must to 127.0.0.1 google.ca and 127.0.0.1 www.google.ca and every other resolver: 127.0.0.1 www.facebook.com and 127.0.0.1 facebook.com would need to be entered into the hosts file.
To exit nano, you must press control (^) + x then Y then return / enter
Type sudo dscacheutil -flushcache do restart dns services. This will activate your changes.


Automatic Blocking

You could do this at the DNS level instead, resulting in no bypass available unless they have the administrative password. 
CleanBrowsing is one of many services that allow for blocking at this level. See IP address list and Setup Instructions for more info. 

Basically, if the user goes to any site CleanBrowsing deems inappropriate, it will block it, and make it so it will not resolve (identify the domain to the correct IP address) to go to the correct website, and will instead display a page saying that "this address is blocked" or something to that result.

The DNS Addresses are as follows


  Family Filter
  
  Blocks access to all adult, pornographic and explicit sites. It also
  blocks proxy and VPN domains that are used to bypass the filters.
  Mixed content sites (like Reddit) are also blocked. Google, Bing and
  Youtube are set to the Safe Mode.


&gt; IPv4 address: 185.228.168.168 and 185.228.168.169 
&gt; IPv6 address: 2a0d:2a00:1:: and 2a0d:2a00:2::



  Adult Filter
  
  Blocks access to all adult, pornographic and explicit sites. It does
  not block proxy or VPNs, nor mixed-content sites. Sites like Reddit
  are allowed. Google and Bing are set to the Safe Mode.


&gt; IPv4 address: 185.228.168.10 and 185.228.168.11 
&gt; IPv6 address: 2a0d:2a00:1::1 and 2a0d:2a00:2::1



  Security Filter
  
  Blocks access to phishing, malware and malicious domains. It does not
  block adult content.


&gt; IPv4 address: 185.228.168.9 and 185.228.169.9 
&gt; IPv6 address: 2a0d:2a00:1::2 and 2a0d:2a00:2::2


Setup for this is as follows:

1. Open System preferences
2. Go to Network &gt; Select the interface being used
3. Click Advanced
4. Click DNS
5. Remove any old listings, as they are likely to be used for resolving first.
6. Press the ``+`` button located in the bottom left, then add the desired servers. 



  Please note to use the servers listed above, both the IPv4 and IPv6 addresses.