I'm assuming the first 6 rules are for internal IP correct?
So client joins, say gets 172.16.0.10 for his IP on a 172.16.0.0/24 network (example). Everything will work for him, DNS/DHCP etc. He just won't be able to go to anything internal after that, like another subnet on 172 etc. He'll be able to reach his gateway and all that though.
I have a group policy setup for company owned iPads. No apple devices can get apple updates, but when I move an iPad over into the group policy, they can get updates (because i'm allowing it), however I am blocking all RFC1918. They still connect just fine and have no issues with DHCP/DNS.
So I don't think you need to specifically allow DNS/DHCP.