I always put our printers on a separate vlan that only accepts connections from our primary vlan. No magic firmware updates anymore.