Untrusted network is not sufficient, you need to cut them off internet, in general.

The internet should very much be considered an untrusted network.

Don’t put it on a network, but also don’t allow it to reach an untrusted network.