For IPv6 networks you're in luck. The hubs are not proxies so the IPv6 enabled IoT device in an IPv6 network can still be blocked at firewall level from accessing the internet. Less that the separation Zigbee provides but better than nothing.
For IPv4 networks you're out of luck. The internal mesh traffic is still IPv6 to the hub and anything crossing into the IPv4 network is done through the hub's IP. No more blocking available unless it's a feature of the hub. I'm not aware of any hub having this kind of FW capability.
For IPv4 networks you're out of luck. The internal mesh traffic is still IPv6 to the hub and anything crossing into the IPv4 network is done through the hub's IP. No more blocking available unless it's a feature of the hub. I'm not aware of any hub having this kind of FW capability.