I use a vlan for certain isolated devices that only certain personal devices have access to via their IP static addresses set in my firewall. That VLAN has no WAN access either. Sure the devices could technically talk to each other, but that doesn’t seem like a big deal since they can’t go external and only my phone and laptop and a few other trusted devices can even connect into the VLAN.