dnsbl exemption of a website but not from others

[michmoor]

Is there a way to permit a single IP to access a domain while also making sure they are protected/not exempted from other DNSBL blocking?

So i want to permit facebook.com for Client A but also make sure Client A cant hit the malware domains listed in my blocklist.

I feel like the answer is no but perhaps someone has a better way of accomplishing this other than spinning up a separate dns server.