Block Internet but not the local network using an Airport Express
Give them a different subnet; if using 192.168.1.1 on your Internetwork, use any other RFC1918 range. 192.168.2.0/24 for example. If you only have the DHCP service on your airport express, consider running one on an always-on IoT device (there are plug and play options for the $2, 0.4W ESP8266  for example), or just assign static IPs to each. No need to set a meaningful default gateway. 

Running a DHCP service on a system you can configure with more granularity will make this easier. No need to run BIND, dnsmasq and many others are smaller and easier. You will want to only offer DHCP leases from this service to your IoT devices, so you need to enter their MAC addresses in the configuration file and ignore all other devices. Argh?

If you have multiple DHCP services on your network, it’s random which one answers a request for address, DNS and route first — ensure that you only run one DHCP service by disabling the one on your airport express. Not possible? Shed no tears, since DHCP is not useful in your scenario, instead use static IPs for this. 

Use hosts files, it’s no hassle if you only have a few dozen devices:
https://www.tecmint.com/setup-local-dns-using-etc-hosts-file-in-linux/

https://gist.github.com/zenorocha/18b10a14b2deb214dc4ce43a2d2e2992

https://m.imore.com/how-edit-your-macs-hosts-file-and-why-you-would-want

A more correct solution is either a VLAN ( https://en.wikipedia.org/wiki/Virtual_LAN ) or a PVLAN ( https://en.wikipedia.org/wiki/Private_VLAN ). But the latter is going too far if you just need to keep a few local things online in your home but nowhere else.

Most network equipment can do this stuff, but Apple’s probably can’t, because it’s a hot-air trend company, and not a consumerfriendly company. No ssh access, and locked firmware:/ If you cannot work it out, just get a nice Ubiquity edgerouter lite.