1. be using open source drivers (e.g., one of the CUPS PCL drivers, preferably on Linux or BSD) on all possible clients;
2. isolate the printer from direct network access (e.g., don't connect printer's Ethernet or WiFi, and instead run CUPS on a RasPi, which talks to the printer only via USB); and
3. consider limiting which devices can access your print server (i.e., via routing VLANs and/or authentication/authorization).
This isn't perfect:
* there are still ways that the printer can get firmware changes against your wishes;
* still ways that it can leak information to HP;
* still ways it's vulnerable to attacks by others; and
* might be awkward to explain when a visitor to your home/office needs to print something.
But I decided the headache of isolating the HP printer a bit (especially from HP), was less than the likely headache of trusting HP more.
(Which is kinda sad, since the company previously known as HP was great.)