>cannot be reached from the internet directly

Stateful firewall that allows outgoing connections and blocks incoming (or maybe blocks both)

In general, you probably don't want to allow unsolicited incoming connections to any devices, regardless of IoT.