Untrusted network is not sufficient, you need to cut them off internet, in general.

The internet should very much be considered an untrusted network.

Don’t put it on a network, but also don’t allow it to reach an untrusted network.

My initial read of proximity being sufficient to exploit 3 is incorrect, so yeah as long as you control the Wi-Fi network sufficiently then things should be fine.