Note, you can always set up a Demilitarized Zone (DMZ) as a VLAN for your IOT stuff, and then use a proxy in case you need those to reach some servers outside. It is not a solution for always-on-internet devices, but for stuff like Shellies it works fine.