Deny everything, Permit only private address range, specifically the subnet the device is on.

One potential solution is to use an old phone and keep accounts/apps that you HAVE to deal with solely on that device. Dont use the device for anything else. Use it only on wifi. Keep it at home.

Yes.

Thanks for starting this! Edit: Perhaps a list of OPNsense resources would look good on the wall, hihi.