a thing I did recently was block all macos daemons that communicate with the network except dnsresponder and rapport (just for ipad syncing). I put the mac studio in its own private subnet behind a managed switch. There were almost 100 services I had to investigate, but it was worth it.