The simplest way is to just connect it to your network normally, and block its internet access at your firewall (the all in one wifi/router/switch that most people have).

If that isn't an option for you for whatever reason, you can do something like connect it to a raspberry Pi via USB, and have that device act as a print server.

You could statically assign an IP to the printer (if it has WiFi/ethernet) and not set a default gateway. It then won't know how to communicate with the internet but still be accessible on the same local subnet.
A more advanced route would be separate VLANs with routing rules between your main vlan and the printer vlan, while blocking all outbound traffic from the printer vlan.

Or you could set up something like a raspberry pi or similar as a print server. The printer connects to it via USB only, so has no access to any networks. And the raspberry pi is the device you configure and trust, which does the translation from network based printing to USB based printing.

Two options:

1. In the printer manual set the IP and mask but do not set the gateway.
2. in the router set DHCP for that Mac address with a fix IP. In the firewall menu block traffic to that IP.

If your router supports it you can provide the printer a bogus default gateway and DNS. That should prevent it from having internet access. You could also likely do this in the printer if it has a way to configure it directly.

A firewall rule that blocks access would be better but will depend on what you have available.

VLAN without internet access is a step above that.

A Raspberry pi print server will work as well by bypassing any network connection whatsoever

Or you could just use a long usb cable and not deal with any of it.

What kind if switch/router are you using? You should be able to set up a firewall rule to block a device from accessing the internet. Of course, the steps depend entirely on your hardware and router OS, but essentially:

• give printer a static ip on you main network
• tell firewall that any traffic originating from printer static IP on the internal network destined to the ISP is not allowed, and vice versa
• assuming printer mac address doesnt change, you can also apply the same rule to the mac address.

My printer is a HP ColorJet Pro MFP (I dont know the model #/what series it is)

So, if you have it visible via USB at the moment, you can probably have the Arch Linux PC tell you with lsusb. That'll list all attached devices.

But, as to the general problem, if you're fine with using USB other than running short on USB ports, I'd probably try one of two things:

• Your USB hub might not support a new enough version of USB. I think that devices are supposed to fall back gracefully, but I definitely have seen the occasional device that does wonky, probably non-standard things with different versions of USB. I have a phone, for example, that will tether using a USB-2-capable cable but not with nicer USB-3-capable cables.

• Just put the other USB devices that you're plugging into the computer on the hub, rather than the printer.

That's simple, you know it works already, and it solves the security issue.

If you want to do the WiFi route, that's going to be entirely dependent upon your wireless access point (you likely have an all-in-one "router" that acts as a broadband modem, router, and wireless access point). There isn't going to be a standard way to do this, and I can't even guarantee that the router is going to be capable of it, but if it has a management interface, probably Web-based, it'll likely have some list of devices, probably sorted by DHCP lease or MAC address, that have paired with the WAP. If it's in there, it'll have some option to cut off access, but again...I can't tell you what it'd look like, since it'd depend on the system.

If that doesn't work (like, you can't make your router do that, or you have multiple devices that you want to be able to print to the thing and don't want to keep your PC on), you may be able to take another PC, connect it to the printer (e.g. via USB) and set it up as a print server running CUPS. That way, there's absolutely no way for the printer to reach the network, and you have control of the device serving the printer to the network.

If you definitely want to go the WiFi route and your router cannot block Internet access to a device that it gives an address to, then you may be able to throw the router into "bridge" mode and set up your own router hooked up to it running OpenWRT or something similar, and have that be the wireless access point for your whole network, and have that disallow access to the Internet to that particular device.

Assign a fixed address to it on the router, and put it in the "no internet access" group under parental controls there.

Maybe there are better ways to do this but I'd put it in a VLAN configured how you want. Any device that gets less trust than your PC belongs in a separate VLAN I think, just as a matter of basic security.