You can’t just intercept tls, unless you can control the certificate store on the device.

In the context of snooping on the SNI extension, you definitely can.

The SNI extension is sent unencrypted as part of the ClientHello (first part of the TLS handshake). Any router along the way see the hostname that the client provides in the SNI data, and can/could drop the packet if they so choose.