For those who know their stuff, setting up a dedicated VLAN for IoT and putting devices in it based on MAC addresses (allow or disallow lists) is a solid option as well and fun to learn.

I have a separate IOT vlan, but ensuring things like AirPlay work correctly is really, really, really annoying.

I don't even want these devices making outgoing connections to the internet. I have my router drop all outgoing connection attempts from my IOT vlan. I can connect to the cameras etc on there from other VLANs but that's the only way packets get out.

if my iot bed can talk to my iot camera, that's still not great. better than it talking to my NAS or laptop I suppose though

Sometimes this type of guest network can provide device isolation: devices can talk to the open internet, but not to anything else on the LAN.

you absolutely need to do this. we call it the "internet of shit VLAN".

This takes on extra meaning when you consider my internet-connected automatic cat litter box.