> The issue is that the kid wants to play a game with his friends [...] This is a clear and meaningful distinction and it doesn't sound supported.

Clear how it could restrict to friends-only when connecting directly to another Nintendo Switch user, but a bit murky how it'd make that determination in cases like Minecraft where the client is connecting to a cross-platform user-hosted game server that is not associated with any Nintendo/Microsoft account.

Could work if you have the parents manually whitelist specific server IPs, as they could with router/firewall, though not sure if "could you whitelist 209.216.230.207 please?" would present a meaningful choice in most cases.

Console minecraft does not allow connecting to self hosted 3rd party servers

Specifically for Minecraft, Realms works for this: I subscribe, I allow my children and friends to access our instance via gamer tag.

Users on the same network can access each others' worlds, at least between XBox and Android, so multi-device in the same building works too.