All Mist managed SSR devices have the below service defined to block UDP 443 from all of LAN segments.  

config authority service block_lan_quic_service name block_lan_quic_service

config authority service block_lan_quic_service description "Block all QUIC traffic on LAN side."

config authority service block_lan_quic_service transport udp protocol udp

config authority service block_lan_quic_service transport udp port-range 443 start-port 443

config authority service block_lan_quic_service transport udp port-range 443 end-port 443

config authority service block_lan_quic_service address 0.0.0.0/0

config authority service block_lan_quic_service access-policy dc1_l1 source dc1_l1

config authority service block_lan_quic_service access-policy dc1_l1 permission deny

config authority service block_lan_quic_service share-service-routes false

Mist by design pushes block_lan_quic service which blocks all lan traffic towards UDP 443.

UDP port 443 is the default transport port for QUIC / HTTP/3. QUIC encrypts nearly the entire transport layer and tls handshakes. Mist blocks it to force client traffic to fall back to TCP port 443 (standard TLS) which is needed for application identification.