I have my work items on a separate network as well but my motivation is more not trusting some random item being pushed down from corp and having it scan my network or something.

Yeah I'm about to do this too just to be safe.

Some of our antimalware like SentinelOne actually does this by default though we have switched it off for privacy reasons (EU)