You should block access to the Internet at the point where your network connects to the Internet. In a Meraki world, this would normally be done on an MX.
Being a PLC network, can you just leave it as a L2 network with no layer 3 configurations? Then it can't talk to anything else which is not on the PLC network.
If you need remote access to the PLC network then using a jump host is more secure. It has one NIC attached to the PLC VLAN, and one NIC connecting to the rest of the network.