As someone who took the plunge years ago, you just have to accept that some programs will just be unusable. There are likely alternatives, though very few will be ‘drop in’ replacements so to speak. So there will be a learning curve.
It’s the price you pay to have full control of your system. As time goes on, it gets easier.
An inbound only DNS forwarding rule would be pointless. All DNS queries should be originating from within the network.
EDIT
I think I see what you’re getting at. Assuming that the firewall is running on the NAS vs on the router.
The OP doesn’t specify, but I would assume the firewall rule would be on the router, as that makes the most sense to force all DNS requests on the network to go through the pihole.