PrintDoc — PRINTER SEGMENT: GENERIC FIREWALL RULES
Translate to your firewall's syntax. Order matters: first match wins.
---------------------------------------------------------------------

#   FROM          TO              PROTO/PORT           ACTION   NOTE
1   STAFF LAN     PRINTERS        tcp/631  (IPP)       ALLOW    printing
2   STAFF LAN     PRINTERS        tcp/9100 (raw)       ALLOW    printing, legacy drivers
3   ADMIN HOSTS   PRINTERS        tcp/443  (HTTPS)     ALLOW    printer admin panel
4   ADMIN HOSTS   PRINTERS        udp/161  (SNMPv3)    ALLOW    monitoring only
5   PRINTERS      ROUTER          udp/53, udp/123      ALLOW    DNS, NTP
6   PRINTERS      MAIL RELAY      tcp/587              ALLOW    scan-to-email (if used)
7   PRINTERS      VENDOR UPDATE   tcp/443              ALLOW    firmware checks (restrict by host)
8   PRINTERS      STAFF LAN       any                  DENY     printers never initiate to staff
9   PRINTERS      INTERNET        any                  DENY     everything else
10  INTERNET      PRINTERS        any                  DENY     never forward 9100/515/631/161

Also on the printer itself:
  - admin password set, HTTPS only
  - Telnet / FTP / TFTP off
  - SNMP v1/v2c off, or community string changed and restricted
  - WSD / Bonjour off where discovery is not needed
  - Wi-Fi Direct off on cabled units