Not 100%, you better should write/chain it this way:
sys-net > Net qube (none) (current)
pi-hole >, Net qube : sys-net (current)
sys-firewall > Net qube : pi-hole (current)
ChocolatVM > Net qube : sys-firewall (current)
(sys-firewall always has to be close to your work/personal/etcVMs and pi-hole / VPN and similar qubes before)
Now, found the way to update the DNS white/black lists on pi-hole. Just login on your pi-hole via browser from your CocolatVM (http://IP_of_the_pi-hole_qube/admin/index.php) with User= admin & Pass= your password you got within the pi-hole installation.
Then go Tools > Update Gravity