Yeah my few Unifi devices (and the controller SW instance) are already restricted to their own VLAN, but I'm going to disable outgoing internet access as well.