We don't block psiphon. It's not using DNS. The best option is to block them from installing psiphone like softwares. Another option is to block users from changing proxy settings when youuse active directory as these softwares mostly set themselves as local proxies.