Blocking devices on the Sky Hub is a little annoying. I think the problem is IPv6. As the Sky Hub itself doesn't have any MAC address blocking like other routers have, it relies solely on IPv4/6 IP blocking.
What's probably happening is some sites are being correctly blocked on the device (e.g. BBC site) but other sites will still work (like YouTube). I've found what you have to do is also add a rule for the IPv6 side as well.
Under "Attached devices", you should see a IPv6 section with devices showing up. I've found the only way to get a block working is when a device broadcasts an IPv6 address that starts with "2a02:c7c:6471:3c00". As the IPv6 rule automatically fills out the "2a02:c7c:6471:3c00" part, you just have to add the last part of the address in the "Source IPv6 LAN Address" field.
Once you've done the above, it should work. The device will still be able to connect to the network, it just won't be able to load any web pages. Unfortunately, the IPv6 blocking is inconsistent since devices seem to broadcast more than one IPv6 address. So what often happens is the IPv6 address changes which removes the block. Other times the device will not be broadcasting a "2a02:c7c:6471:3c00" address making blocking impossible.
The way around that is perhaps disabling IPv6 on the router. That'll force it to only use an IPv4 connection which should make the block work due to the IPv4 rule and the fact a static IPv4 address has been assigned to the device. However, I've not done this myself, nor know if there's any disadvantage to disabling IPv6.
I have briefly used a router that did not have IPv6 enabled by default and my connection worked OK. So if disabling IPv6 is an option, that's probably what you'd have to do to be able to properly block a device from accessing the Internet.
If that's not an option/feasible, getting a third-party router will be the next best option. The third-party router will likely have a proper MAC address block. The Sky Hub is really basic unfortunately.
