TLS Inspection & Google Passkeys

I have TLS inspection setup on my main network running through a Sophos XG (20.0.2 MR-2) and am trying to setup Google Passkeys for G-Mail. The passkeys were setup using a different network connection...
DNS CNAME? Google Safe Search Enforcement

Forgive me but I forgot if this is even possible with the XG 330. I am trying to enforce Google Safe Search via DNS with Web Proxy Filtering turned OFF because its blocking a Desktop web app's connection...