Don't trust them. Add a system you control between the device and your internal network. If you're just worried about your traffic privacy and not just internal resources, establish an end-to-end encrypted tunnel from that jump system to a network or VPN provider you trust.

Edit: excuse me, I misread your question. I thought you were asking for best practice. I don't have have a specific hardware recommendation (because I don't trust them :) )