pfBlockerNG can do this.
Also, the new tag feature in Unbound can do this, with no additional components needed. More details at Unbound's home.
It's only supported in Unbound 1.5.10 onwards, so you may need to update your pfSense.
The config is a bit long winded, even convoluted, sophistication comes with complexity. Perhaps a pfSense GUI for it might appear for it in the future. It is a new feature.
pfSense web admin gui > Services > DNS Resolver > Custom Options
# give pfSense a server: tag so it puts directives in correct place
server:
# define a new tag
define-tag: "websiteX"
define-tag: "websiteY"
define-tag: "websiteZ"
# create access control entry
access-control: 10.1.1.0/24 allow # group A
access-control: 10.1.2.0/24 allow # group B
access-control: 10.1.3.0/24 allow # group C
# tag the access
# allocate ip ranges to the tag
access-control-tag: 10.1.1.0/24 "websiteX"
access-control-tag: 10.1.2.0/24 "websiteX"
access-control-tag: 10.1.3.0/24 "websiteX"
access-control-tag: 10.1.1.0/24 "websiteY"
access-control-tag: 10.1.2.0/24 "websiteY"
access-control-tag: 10.1.3.0/24 "websiteY"
access-control-tag: 10.1.1.0/24 "websiteZ"
access-control-tag: 10.1.2.0/24 "websiteZ"
access-control-tag: 10.1.3.0/24 "websiteZ"
# create the local-zone, and allow normal service
# which allows non-blocked users access
# and allow all types like A and AAAA and CNAME
local-zone: www.websitex.com typetransparent
local-zone: www.websitey.com typetransparent
local-zone: www.websitez.com typetransparent
# tag the domain
local-zone-tag: www.websitex.com websiteX
local-zone-tag: www.websitey.com websiteY
local-zone-tag: www.websitez.com websiteZ
# ensure local data served first
access-control-tag-action: 10.1.1.0/24 "websiteY" redirect
access-control-tag-action: 10.1.2.0/24 "websiteZ" redirect
# Send users to your polite internal block page
access-control-tag-data: 10.1.1.0/24 "websiteY" "A 10.1.1.1"
access-control-tag-data: 10.1.2.0/24 "websiteZ" "A 10.1.1.1"