Separate WIFI/network for IoT devices.
Do not route to the internet in any way (skip buying anything that requires it).
Connect to windows (or other OS) PC only, non-routable.
Disable all connections from that network to the PC.
The best combo I have found is non-cloud smart devices and a solid firewall. I'm confident enough that my lightbulb isn't going to hack my Mac/Windows machine, and I can still control it when I'm at home with my phone. If I want outside control, then it's vpn time.