I did some work on locking down an Android tablet, found it quite hard to do. With CDNs etc in play, the IP ranges that need to be opened are quite vast and generic (i.e. lots of cloud providers that host half the Internet).
I used Squid HTTP proxy for URL inspection, but still, many generic domains being connected to. And I found whether an app, including some Google system ones didn’t always respect the device’s proxy settings and would simply fail.
For TVs, I’ve kinda gone meh, and isolated them from other devices, but given them Internet access.
I haven’t got into this yet, but the approach I was going to look into was using an IP camera and CCTV style software, which gives me my buffered recordings. I can then choose to process the image for motion, or use a PIR or push of the door bell to trigger the save (which is less intensive processing).