One potential solution is to use an old phone and keep accounts/apps that you HAVE to deal with solely on that device. Dont use the device for anything else. Use it only on wifi. Keep it at home.

Yes.

Deny everything, Permit only private address range, specifically the subnet the device is on.