What is certain sites? X-rated? Political views different than your own? Only allowing religious content?
White listing for total control but high effort and use a black list less control but less effort. You could always not allow usage without a parent present but that's extremely high effort.
My thinking was whitelisting in the beginning, but I'm not sure what I actually want to allow access to.
It's better to have DNS policies: NextDNS, Pihole, Adguard, etc.
If you go with a DNS filter, make sure the browser they will have access to does not use DoH (Firefox does conditionally by default now).
At which point, they don't need digital devices. Take the time and effort you'd spend on that and buy them legos or something age-suitable, and keep them in the physical world as long as you possibly can.
My kid has a tablet, but we limit the amount of time he spends on it. Seems healthy to me.
If it's anything with touch screens, it's designed to be so easy that you don't have to worry about it. They'll pick it up trivially later in life.
If it's how to use a keyboard, mouse, and Linux shell? Have at it. I've met more than a few 8-10 year olds who literally don't know how to use a mouse, because everything they've ever interacted with is touch screen.
But I'll take "a kid who played with legos and outside a lot" over "a kid who was electronically literate" any day.
But I do want to build some level of digital literacy, and most importantly just make sure they learn how to type properly when the time comes. Hence the question, I want to introduce them to tech with extreme caution.