Of the options you listed, only Invizible Pro even meets your needs. So there’s nothing to choose here, really. Though: You may prefer TrackerControl with Android’s built-in Private DNS (but that’s DoT not DoH).
While NetGuard doesn’t require root, I think non-root firewall apps on Android are not as powerful as rooted firewall apps or firewall apps that come bundled with the OS (such as Datura firewall with CalyxOS).
Also, unless you absolutely know what you are doing with the firewall, don’t root. Just a note to remember.