Just… don’t connect them to the internet? Or if you must connect them for dumb shit like system updates, put them behind some access control where the only access they have is the server they get updates from.
I regret to inform you that preventing devices from getting online is getting more difficult: three years ago Amazon began allowing other companies' products to use their BLE-and-LoRa-based mesh network to get online via your neighbors' internet-connected devices.