I go one further - the IoT VLAN (Sonos, Philips Hue, wifi controlled light strips, TV's) is hard segmented from my "trusted" VLAN (except for some specific hole

I go one further - the IoT VLAN (Sonos, Philips Hue, wifi controlled light strips, TV's) is hard segmented from my "trusted" VLAN (except for some specific holes punched so things like SSDP and streaming from a media server work).