Honestly, just muting the microphone is mostly fine. I really don't believe they transmit shit to the cloud when they're muted. I've heard a lot of people talk about how they answer when they're muted so they're still listening, but they process the "Alexa" (or whatever wake word you use) locally and then send a short buffer of recording along with everything you say following it to the cloud to process. It's likely they just hear that you said the wake word locally and then say "Hey I'm muted" without sending it to the cloud.

I know this answer isn't the most privacy oriented on a privacy community, but I think this option is more reasonable than you'd think.

You mentioned blocking with DNS. You could try setting up Wireshark or something and see if there are any packets from it when you say the wake word while it is muted and how it compares to when you say the wake word when it's unmuted.

Unfortunately the red LED would always be on because it's muted, but you could cover it with opaque tape. Like electric tape.