It depends a little how much you want to do yourself.
If you already have a hass instance running, you could get a zigbee dongle, and a couple of sensors (SNZB02 temperature sensor, for example) to get started with things.
On the Hue hub, it mainly talks to Hue gear. The encryption on the newer Hue equipment hasn't (to my knowledge) been broken yet, so you need to use a Hue hub. The hub has integration with hass, so you can effectively control Hue via Hass.
You can block Hue from the internet in a few ways, depending on networking ability (easiest is just manually setting the IP, and giving it a bad gateway, though this isn't 100% guaranteed to work).