For it to be effective, all it needs is its complement: An easily recognizable green label saying "Doesn't connect to the internet", which is only allowed on the boxes of devices for which this is the case.

Maybe some more levels in the middle like "only connects to the internet for firmware updates" (yellow) and "doesn't require internet access for core functionality" (orange). Basically Nutri-Score [1] for hardware.

[1]: https://en.wikipedia.org/wiki/Nutri-Score