Comment by ahknight

Super easy: don't give them a network and use a dedicated STB that's kept patched instead. Ta-done.