As long you have incognito setup you don't have to worry about about that NAND connecting to the internet, I have seen people recommending removing network info prior to creating emunand, as people are worrying about connecting online. I mostly play on CFW switches, as I have a separate unit just for online stuff. You don't need 90DNS if you going to use incognito, I been only using Incognito on my units, keep in mind 90DNS is hosted in Europe and Australia so download speed would be slow, if using HBG shop, also that if the server goes down your system might download updates. There aren't a lot of homebrew require internet usage except like HBG Shop, the Homebrew app store, Kosmos updater etc.
AutoRCM is recommended if you want to preserve your fuse, if you have an unpatched unit you can get a mod chip (Trinket M0) fitted so it autoboot into cfw for you. As some people like to preserve their fuse even though they update to higher firmware, emunand is another alternative if you want to preserve your fuse, and just update your emunand, that what I am doing on one units that is on 3.0.2 sysnand but 8.1.0 emunand.