Yes, each enterprise customer of the IoT CSP has its own firewall and routing definitions. They can decide to block traffic, send traffic to their Enterprise VPNs, or send traffic directly to the Internet. A stateful firewall protects all traffic.