I did this with my Petlibro cat feeders. It was significantly easier: redirect the MQTT server to a relay. No TLS, no device key, user & password for device transmitted in plaintext. Needless to say, the devices are now blocked from the internet and managed with a local mosquito server.