It's blocked at my router. I've had two routers the past few years, an ASUS AX5700 (RT-AX86u) and a NETGEAR AXE7800 (RAXE300). Both allow for blocking a device from internet without blocking LAN access. So you give it an IP on your network, and then just block it from internet. I use the Netgear currently and have the ASUS as a backup device.

I don't know if it's true, but I've read that some TVs will scan and seek to connect to open networks if it's not connected at all, so I figure that way it's totally blocked, and I still have access to its APIs for Home Assistant and Homekit use.

You'd need to set up a firewall rule on your router to block that device from accessing the internet. If you've got a fancy enough router you could set up a VLAN and second SSID for all your IoT things and only whitelist connections and devices you want to allow. That can get a little tricky to set up though