It's blocked at my router. I've had two routers the past few years, an ASUS AX5700 (RT-AX86u) and a NETGEAR AXE7800 (RAXE300). Both allow for blocking a device from internet without blocking LAN access. So you give it an IP on your network, and then just block it from internet. I use the Netgear currently and have the ASUS as a backup device.

I don't know if it's true, but I've read that some TVs will scan and seek to connect to open networks if it's not connected at all, so I figure that way it's totally blocked, and I still have access to its APIs for Home Assistant and Homekit use.