I have some 'smart' devices on my network that i DO want on the network, because I want to access their local APIs over the LAN. But i do NOT want these devices to be able to connect to the internet to 'phone home' at all. 

Is there a way to set up something like that, where I can add these devices's MAC addresses and they get blocked from NAT/the internet entirely?