I stuck IOT stuff on a cheap linksys WRT router with ExpressVPN firmware. It forces all clients out over that so Nest, Amazon et al can’t snitch or sell my demographics or billing address to people. Not tying it to my home IP anyway.

but this require a DMZ or a second external IP address (I have both with centurylink) because if it’s double nat on your home network. Thee devices can access your home network.