@casino For normal use, you need to enable both “Enforce Access Control” and “Block proxy”. After you upgrade, “Block proxy” is checked by default on profiles with “Enforce Access Control” enabled.
The purpose for separating it out is to allow the user to optionally disable it when needed. Such is the case for some school devices, which comes with parental controls enforced by a mandatory proxy. In this case, we trust that the school proxy is doing its job, hence allow it on the router.