Hi,
In my opinion this is totally options and how you want to override the response.
in my use case any rpz rules hits will redirect to a landing page which contain information about why this domain is blocked but this is mostly for domain that usually access by user - category filter (like adult domain, gambling domain, phishing etc)
but for domain that categorized as malware or ransomware i will choose to use nxdomain or nodata because the domain is not intentionally query or access by the user, but mostly queried by malware in the background so we dont need redirect to landing page.
