It varies by device. Sometimes you need the vendor app to configure the device to join your Wi-Fi, but then you can use its local API and firewall them off from

It varies by device. Sometimes you need the vendor app to configure the device to join your Wi-Fi, but then you can use its local API and firewall them off from the internet. This is the case with TP-Link's Kasa devices. Other times you can (/must) do the setup yourself and don't need to use the vendor app. This is the case with Broadlink devices where you join their provisioning AP and run a command to set up the WiFi credentials. It's rare that you can just turn off the cloud features altogether, but for devices with local APIs like these you can just firewall them off or put them on an IoT-only WiFI network with no Internet routing.