Block all traffic to Apple at the router, except (e.g. use a different SSID) when you need to perform OS/app updates.
Apple kindly publishes IP exception lists so you can still receive notifications, while blocking the rest of 17/8.
Apple kindly publishes IP exception lists so you can still receive notifications, while blocking the rest of 17/8.
Since notifications are user-visible, one can audit for unexpected, non-notification traffic to Apple's advertised notification-only IPs.
If a large corporation officially advertises to enterprise customers a bounded, testable claim (e.g. traffic to these IP addresses is limited to notifications), then that claim can be subject to ongoing audit by the IT teams of multiple, independent, enterprises.
Verified accountability is far superior to trust. Step 1: vendor corporation makes a bounded, testable, claim.