I have a Vigor 2860 which is connected to VDSL2 but also has a 3G/4G failover connection using a Huawei USB dongle on WAN4.
This works fine but I want to make sure the kids don't quickly burn through all of the data allowance on the 3G/4G contract in a fall-back condition by watching YouTube and the like. I am aware of WAN budget (WAN >> WAN Budget) but this cuts everyone off once reached.

Ideally I want to make it so they can't watch YouTube in a fail-back condition but can continue to use the web and mobile apps. I have considered QoS for this but not sure what to set (Bandwidth Management >> Quality of Service)
Failing that I was thinking of a firewall rule to block their devices (static IPs set) from using WAN4 but couldn't see a way of doing this.

Any thoughts appreciated.

It's best to use a Load Balance / Route Policy rule for this particular scenario - with that you'd create policy route rules for things that you do not want to fail over to 4G (either as source or destination) with no Failover options configured, so the PCs (source IPs) / websites (destination IPs (or hostnames with 3.8.4 firmware)) would stick to the Internet connection specified in the policy route rule.

I would also setup the WAN Budgets under the WAN Section, this will at least allow you to see whats being used each month, but it also has the option to shutdown the WAN interface if it exceeds the Budget you have set. So you could say set the Budget to 500Mb less that the 3G/4G Allowance you have with you Provider and tell the WAN4 to shutdown if this is exceeded.

John.