Replying to @Carl@anarchist.nexus
Those devices should most certainly be on two separate networks. Internet facing devices should be on a DMZ and not be allowed to talk to your internal network. You can then allow your internal network reach your DMZ devices, but only allow return traffic from the DMZ.