> - distrubute a native (electron?) app that interfaces with my device and trusts my cert, and disallow direct browser access.

This is the most secure choice, using something like websockets to transfer data only.

Unless your product is completely offline and never connected to the internet, I don't think an IoT device that runs a web server is ever a good idea. All it takes is one successful remote attack, and soon your users could be installing ransomware at the device's direction!

Don't serve HTML/JS from a device that you can't physically pull the plug on.