Don't assign the device a default gateway (or set it to 0.0.0.0 if one is "required"). I have thought for a long time that we'll one day get to the point where

Don't assign the device a default gateway (or set it to 0.0.0.0 if one is "required"). I have thought for a long time that we'll one day get to the point where the best thing one can do for a host's security is to not allow it to generate traffic that can reach the Internet. Just like we have default deny on incoming traffic, we need to start using a default deny on outgoing traffic as well.