Untrusted devices should be on a separate network where they don't have access to any data worth exfiltrating.