I treat those devices and untrusted by putting them in a separate subnet that cannot talk to the subnet where I have my other devices (computer, printer, smartphones, etc).