I have a device which I don't want to have any communication with the outside world sans any initial updates/etc (say, an IoT device that would otherwise phone home). I would still like to be able to communicate with it from local devices on my home network (e.g. mobile phone / desktop) which do have access to the outside world. Assume that anything that it connects to (e.g. a mobile app on the phone) is already locked down / safe -- I am scoping this question to just the target device itself. What would be the minimum configuration required to do this?
Traditionally most concerns of this nature are out of concern for compromised devices, so higher risk devices might be put on a separate VLAN. My concerns are strictly privacy related, and communication between devices on the same network is desired for convenience.