I’m paranoid so I have created a physically separate network for the IoT stuff. Everything gets its IP from the same server from a /25. The lower is the trusted network, high IPs are not. IoT network devices cannot open connections to the other network. A bit awkward, but works fine.
https://m.youtube.com/watch?v=4WTrXBWx5uw