consider* putting endpoints on a private overlay network in which network access is cryptography-gated (e.g. x.509 cert based). then, a misconfigured endpoint (or a zero day etc.) can't be exploited by any_actor_on_the_internet - actors need to first complete the provisioning process you choose to enforce to be authorized to use the private overlay. *not one size fits all, e.g. bad option if endpoints need to accept…
Do you mean clients for the last part? I'm not a networking expert but I don't see how layering on certs here is going to help?