So am I reading this right? Run all your user traffic to a self hosted DoH server and forward those requests to another DoH? To protect my users from the bad gu

So am I reading this right? Run all your user traffic to a self hosted DoH server and forward those requests to another DoH? To protect my users from the bad guys hiding their traffic in DoH, how would I detect the bad guys passing DoH traffic on my server? I’m asking because I’m looking to do this for my users whenever we get back to the office.