I block facebook for my portable devices by setting up a DNS server.
You have to enforce that only you DNS can be used. VPN can use a external DNS server so that will slip past you.
I block with DNSmasq using this three lines:
# Geen standaard toegang tot Facebook Instagram Whatsapp
server=/facebook.com/fbcdn.net/facbook.com/fb.com/fbsbx.com/facebook.com.edgesuite.net/instagram.com/
server=/facebook.net/instagramstatic-a.akamaihd.net/instagramstatic-a.akamaihd.net.edgesuite.net/
server=/cdninstagram.com/tfbnw.net/whatsapp.com/fb.me/