Is my Nanoleaf controller supposed to keep a constant connection open to their servers?

That steady connection is almost certainly an MQTT link to the vendor's cloud, and yes, it's normal. These panels keep a persistent connection open so the app can control them from outside your house without port forwarding, and so the cloud can push firmware updates. It'll sit there idle for days doing basicly nothing until you touch the app or an update lands. So don't panic just from seeing it in the device list. But your paranoia isn't entirely misplaced either. People have actually pulled the firmware off these controllers and looked inside, and some brands do have a cloud-triggered remote access channel built in, meant for support and debugging. The intent is legit-ish, but it does mean the vendor's servers can talk to the light and not just listen to it. Whether that's a backdoor or a feature depends on how much you trust their key management, and that's a fair thing to side-eye. The guest network thing genuinely helps, it's not overkill. If a panel gets compromised, an attacker sitting on that fixture can poke at everything else on the same subnet, like your laptop and cameras. Put the lights on a separate SSID or VLAN and most routers will block traffic between it and your main network by default. Takes ten minutes and costs nothing. Your work stuff especially deserves that separation.

As for seeing what the connection is actually used for: partially. Your router's logs or an DNS-level filter like Pi-hole will show you which vendor domains the controller talks to, which tells you if it's phoning home to weird places. What you can't see from your end is the contents, because it's encrypted both ways. So no, you can't fully verify it, it's trust-but-segment. If a vendor ever does something you don't like, like bricking devices or changing their privacy terms, the nuclear option is blocking their domains at the router and running the lights purely locally through Home Assistant or similar, if your model supports it.

I definatly agree that segmenting the lighting off the main network is the safest bet for this kind of hardware. That whole idea of a light switch being a pivot point into your primary network is a real headache. I actually had to set up a separate VLAN on my router a while back, and once I did, it made the setup much cleaner. Most routers have an option to just label devices as IoT, which really helps enforce that segregation without diving into complicated subnet changes. It just makes the whole setup feel more secure.

I’ve been wrestling with these panel systems for a while and honestly, the constant cloud pings are less scary than the dependency. You’re handing over total control to some faceless corporation. If they decide to shut down the service, your whole expensive living room setup is toast. Back when I started using smart tech, we were at least using solid physical switches that were totally independent. It always seems like the biggest headache isn't the data security, but the sheer fragility of relying on proprietary vendor servers to even make the light turn on.