I am looking for a setup that does not need to phone home to the vendors servers. Is the Philips Hue Bridge a good hub? Can you work with most of the Philips Hue stuff without phoning home?
It depends a little how much you want to do yourself.
If you already have a hass instance running, you could get a zigbee dongle, and a couple of sensors (SNZB02 temperature sensor, for example) to get started with things.
On the Hue hub, it mainly talks to Hue gear. The encryption on the newer Hue equipment hasn’t (to my knowledge) been broken yet, so you need to use a Hue hub. The hub has integration with hass, so you can effectively control Hue via Hass.
You can block Hue from the internet in a few ways, depending on networking ability (easiest is just manually setting the IP, and giving it a bad gateway, though this isn’t 100% guaranteed to work).
Do you already have a Home Assistant server set up? If so, I’d suggest getting a USB Zigbee Dongle like this one.
Any reason for picking the Sonoff instead of the Conbee II? (genuinly curious)
Conbee2 is of a previous generation and cannot handle the number of zigbee devices that newer ones can. I had a Conbee2 and I vastly prefer the newer ones like the sonoff and the tubeszb controllers.