blocking vulnerable website

You of course need to control either the end devices or a device like a router or firewall in the path. You cannot if the users are using say their private cell phones and using it as a hotspot.

You can try to block it via something like opendns but that only stops the lazy users. The only way to ensure it is blocked is to either put a firewall rule in that blocks the IP or you put in a dummy route for that ip that points to the local host or router.