I go further and run every single device isolated as if every device runs on a private network with only itself.

It forced me to rework some things, like our printer arrangement, but overall it's bomb proof.

I also use family.dns.mullvad.net at the router level to block ads, trackers, malware, adult content, and gambling.