If you control DHCP and know the MAC address of those embedded devices, you can serve them a non-existing gateway so that they simply won't have a path outside of your home network.

Of course, that assumes IPv4, whereas with IPv6 and SLAAC I believe the only way is to firewall them out.