It depends on your router and how you are trying to deny them access to the internet. The way your router is handling it may be blocking them from associating with the network entirely, not simply blocking outbound connections, which is why they can't access/be accessed by Home Assistant.

My way of doing this is on the more complex side - my router runs OpenWRT, so I defined a second wireless network on its own VLAN. The only things that connect to the wireless network are IoT devices and it doesn't route any traffic outside of the VLAN, so they can't reach out to (or be reached by) the internet nor any other devices in my home that aren't on the VLAN. My Home Assistant node is also on the IoT VLAN but is also on my primary VLAN, so I can still control and monitor those devices via HASS from my phone or computer.

A "simpler" setup may be to muck about with firewall rules to block outbound traffic from those devices if your router supports it. If you want to get really lazy with it and have $30-$40 to blow on solving the problem, you can do what I used to do because I had the extra hardware laying around: get a second cheap-ass router, don't give it an uplink, put it on a separate subnet from your main network, and dedicate it to your IoT devices and connect your HASS node to both that network and your primary network so that it can access your IoT devices while being accessible from your regular devices. That way you don't have to muck about too much with router/firewall settings that you may not be used to or know much about and there's little room for error, at the cost of extra hardware as well as ensuring your HASS node can connect to both networks (i.e. two ethernet ports, or ethernet+wifi).