Depending on the capabilities of your WiFi gear, you can just run these devices off of a second wireless network which backends onto a separate VLAN. You can t

Depending on the capabilities of your WiFi gear, you can just run these devices off of a second wireless network which backends onto a separate VLAN. You can then use firewall rules to determine what traffic is allowed to pass between VLANs. I do this for my cameras (no traffic out from the VLAN, but allow connections in from the NVR machine) and IoT devices (traffic to the internet is allowed, only some traffic to my other networks is allowed). It works very well. I use Unifi for my networking gear, but I've done the same thing with DD-WRT on an Asus router/AP device.