I think you'd have to write a DNS server where you choose what to return NXDOMAIN for. So updates.samsung.com, sure, let it connect, but spying.samsung.com, block. (Obviously, do not allow connections to any IP addresses you haven't yet approved, which you approve by manually retrieving the DNS entries.) This can be defeated with DoH, or by different business units inside the company cooperating to use the same domain for different purposes, or by doing the TLS negotiation with good.samsung.com but setting the Host header to evil.samsung.com, etc. The first is too scary to ship (you have to keep the DoH's IP address and certificate safe forever; I wouldn't sign off on that), and the second made me chuckle as I was typing it.

I'll add that "back in my day" a screen could display the video signal on its inputs without ever needing a software update. But I suppose automatic time zone changes are a reasonable reason that code needs to be pushed post-manufacture. Then again, who needs a clock on their TV?