Pi-hole.

My two top-blocked domains are related to TP-Link.

While I can’t always get local-only devices, I can at least separate their traffic and block the shit out of them.