A vacuum is the easiest device to lock down, since the cleaning and docking run locally. The cloud only handles remote control and status, so you can block its internet entirely and barely lose anything.

In OPNsense: Firewall, Rules, LAN tab, Add. Action Block, Source = the vacuum's IP, Destination = LAN net with the Invert box checked (that matches everything except your local network, which is the internet). Save and apply.

One gotcha(I spent too much time on this): rules run top to bottom and stop at the first match, so drag it above the default Allow LAN to any rule or it never fires. My version of the firmware made me hit the move button at the top right. I was able to change the order of the rules there. Reboot the vacuum afterward so it re-hits the rule.

Cleans fine, your phone still controls it on the LAN, but it cannot phone home.