The solution to this is very simple: cut off their access entirely.

I use an SSL proxy at home and if you attempt to pin certificates such that the local certificate store is ignored or inaccessible. Your device can be guaranteed to not have access from my network. End of story.