Would a properly installed firewall stop someone from accessing this via the IP?
The short answer is yes, but the longer answer is it's complicated.
Devices with back doors may also dial out from your network. It's common for devices to phone home to check for updates and such so such activity is not necessarily even seen as suspicious, though of course in an enterprise context you should be disabling automatic updates and/or reconfiguring them to use internal servers.
Devices which might be malicious should be segregated onto their own physically isolated networks connected only through firewalls with policies for both ingress and egress so that you can control both types of threat. But it's better still when your software and firmware is OSS, and you build your own images and deploy them to the hardware yourself to have the best chance to avoid the possibility in the first place. Even this doesn't completely preclude such attacks, but it does offer some protection (mostly in proportion to the level at which you're auditing the source files, and the percentage of OSS.)
TL;DR: It's smartest to segregate and whitelist traffic in both directions for sketchy devices.