routers could solve this for consumers with a checkbox for "intranet only"
99% of consumers won't know how to setup a firewall but could handle a checkbox
only problem I have is I can't seem to punch a hole for time sync and it won't use my local intranet time server
Time server can be specified with DHCP, if you want. Options 4 [deprecated, but that doesn't matter] and 42.
No idea if that helps with your particular devices; they are, of course, free to ignore those fields.