The Core

So in addition to putting your IoT stuff on its own network segment, I'd highly suggest you throw a PiHole into the mix. You can really tame and micromanage a 'smart TV' or other device with this.

What's this Streisand stuff about?

A lot of people like to run a VPN with their PiHole, and then have the VPN use the PiHole for DNS queries as well. Probably a fun addition, but not necessary for the PiHole on your network.

And now my entire home network is forced through multiple PiHoles, whereas before only certain segments that I personally used had the PiHole love. And I tightened the PiHole down using internal DNS with Unbound. No more DNS calls to Google or Cloudflare. The PiHoles are really essential...my TV seems to be lonely as it appears desperate to call home.

I've read that the newer "smart" TVs know when they're being blocked and will send out gibberish domain calls when they realize they can't phone home. They know they're being blocked.

The thing we have to watch for now is encrypted DNS calls that bypass the PiHole. Some Google devices will do this already. They can bypass network DNS this way to make their precious call home.  Ever wonder why Google and the other big boys are pushing for this secure DNS?

Then there's malware that can run its own encrypted DNS that can use this same functionality to call home through your network protections... It's getting more difficult to keep up.