If you don’t know whether or not your employees are in the office and your business is running as it should, then you don’t NEED your employees in the office. A return-to-work mandate serves no purpose other than making life harder and with no tangible benefit.

That being said, wouldn’t it just be easier to monitor VPN usage to see who’s working remote?

You’re correct about an outside individual accessing your network, but that still doesn’t prevent a device on your network from phoning home.

I think most people have at least some open ports, though. Isn’t port forwarding required for a lot of online games? It used to be at least.

You should never fully trust ANY device on your network. Even if it’s not collecting your personal information and sending it off to who-knows-where, there could always be a zero-day exploit just waiting for someone to find it.

The best solution IMO is don’t let your smart devices have access to the internet. Put them on a VLAN, block them at the firewall, whatever method you prefer. Accessing your home network remotely is one thing, but your air conditioner doesn’t need to INITIATE a connection to the outside world.