Note that GeoIP is unreliable so you may accidentally block some IPs that aren't Chinese. Even whois is not 100% reliable given how often IPv4 addresses are traded these days.
If some Chinese-made technology really phones home, it's more likely that they'd communicate with a US-based server that would then communicate to servers in China behind-the-scenes.
I use *.home.mydomain for publicly-accessible IPs (IPv6 addresses plus anything that I've port forwarded so it's accessible externally) and *.int.mydomain for internal IPv4 addresses.
I have a $5/year MXRoute account that I still use even though I self-host my emails. I use MXRoute as an outbound SMTP relay since they've got all the IP reputation stuff figured out.
I know you said to exclude VPS, but I've got some of VPSes around the $15-$50 per year range, since it's nice having my sites hosted on higher-end enterprise-grade hardware than what I'm using at home.
I'm considering paying for Kagi (a paid search engine) because it's ad-free and the results are legitimately better than Google.
Use a good backup system like Borgbackup (with Borgmatic to automate it).
Does your provider not offer IPv6? That's usually the best way to avoid all NAT, including CGNAT.
$5/m is pretty expensive for a VPS if you're just using it for Wireguard. A $15/year 2 GB RAM / 20-ish GB SSD VPS would be totally fine for that use case.
Black Friday is coming up... The best time of year for VPS deals. Even without Black Friday deals, providers like GreenCloudVPS (their "Budget KVM" packages) and RackNerd have good deals.
Silicom is Israeli too, as was Mellanox before the Nvidia acquisition.