You can't trust the devices themselves to tell you that, so the best approach is to put them behind a (hardware) firewall that protects both ways, not just from

You can't trust the devices themselves to tell you that, so the best approach is to put them behind a (hardware) firewall that protects both ways, not just from external connections but also to prevent devices to call home if their behavior is unclear.