If I use MAC filtering on my router to prevent internet access for a smart device e.g. IP camera, could it feasibly change the MAC address to get around this and leak data to a remote server? If so, what can robustly prevent internet access?
Some devices randomise their MAC on start up, and that's a trivial function, so that's a feasible scenario, though unlikely. Benign IoT devices don't tend to want to avoid detection or stable identification.
The best case is to set up a VLAN or a separate network for your IoT devices that blocks all outgoing traffic to the internet.