Firewall them all, god will know its own
Firewall eos. Novit enim Dominus qui sunt eius
Cloud? What cloud? Once again, how do you access cloud across a machine that has iptables -P FORWARD -j DROP?
There is a reason why my media center has two NICs and the TV, BlueRay, etc are all on the second one. They are sometimes allowed an occasional excursion onto the wider net. But not a long one. So they can get new firmware or fetch something they need. Then, their access is turned back off. No ifs, no buts, no coconuts. And no Siris, Alexas, Bixbys or Google.