Their knowledge stops at creating sway screenshots.

I’m paranoid so I have created a physically separate network for the IoT stuff. Everything gets its IP from the same server from a /25. The lower is the trusted network, high IPs are not. IoT network devices cannot open connections to the other network. A bit awkward, but works fine.

I don’t see how VLANs would help OP.

I agree, people come here to learn. Don’t gatekeep information.

The first sentence is not really true though.