Separate vlans for iot devices with strict firewall rules is generally enough to mitigate the threat of most iot devices phoning home i think. We’re already in the territory of hobbyists who should be able to manage that with these suggestions like ubiquity and frigate.