Windows Firewall: allow only certain DNS servers

In my organization (which uses two network DNS servers and a local DNS resolver per laptop) I want to restrict DNS requests to only

• 127.0.0.1
• 192.168.10.201
• 192.168.20.2
• 1.1.1.1
• 1.0.0.1

and block all other DNS requests. I want this by creating Windows Firewall rules in the GPO.

So how can I block TCP/UDP port 53 traffic except those IPs?

This configuration only applies then to laptops. When they are in the company network, the network firewall ensures that outgoing DNS requests are all blocked except for the local DNS resolvers. The Windows Firewall should block using other DNS servers while outside and using phone-hotspots or WWAN adapters.