That still doesn't help with direct IP communication. You'd have to block all traffic except services you want to interact with. That probably means never getting a firmware update or at least uploading some telemetry when you allow a connection back to the mothership for a firmware update.
There's no winning with IoT.