Sysadmin

Buy the 5yr warranty extension. Yes you can delay updates/make them manual. If I were you and weren't ready to give up the fortinet I'd double NAT it for a while, I think you'll find the benefit of using the complete ecosystem will convince you to give up the fortinet even if there are a few features that fortinet do better.

You can buy a firewall model that has the required controller built in requiring cloud connection or 2nd to that I'd setup a VM using the http://glennr.nl/ scripts as the controller. The scripts are reliable and capable.

I used to run 3rd party, like Sonicwall, firewalls with Unifi wifi for a few years but recent improvements to their approach has made me switch to the whole eco system now and I prefer it.

I am using their WiFi at home. The AP' have no internet access an I am self hosting the controller which also has no internet access. You can download the controller as a deb package on your PC transfer to the server and install or upgrade. I'm shutting the controller when I briefly open the FW for upgrading Debian. Don't think they have info or control over my network

most of their stuff are local, unless you have activated remote access on your unifi controller which will require an online account on unifi (ui.com)

i only have their aps and my unifi controller is hosted on a local machine, and so far i haven't found any suspicious queries from them, i havent done any packet trace or port checks because they seem ok for me

where the unifi controller hosted on a deb machine

one of the ap

as for access control, if your unifi controller is hosted on a local machine then it will just use specific ports that ubiquiti utilizes that im not familiar with (or too lazy to do a port scan). you may also host your controller online via hostifi or other providers or a diy cloud server (if you're onto that)

for updates, unifi controller will notify you if there are updates but its still up to the controller admin if they decided to do so.

as for janked device configs, i mostly experienced it on controller version 6.x.x and 7.x.x but not on most recent one (9.x.x) and yes it requires a unifi controller admin acct, you may also do scheduled backups of your configs so you can revert back just in case. and if you have no choice then you could locate device > poke reset > re provision on controller.

Just a note we use Ubiquiti at our office with an on prem network controller so none of the devices talk to the cloud. However some of the nice to have features on the controller require a unifi gateway (router) to use, such as some of the web filtering. Double check which features require what before you commit.

Honestly tho they're such a step up from most enterprise bullshit I can't complain.

Personally, I like unifi. I haven't noticed any strange traffic from the APs or the controller (local). One note, though: always go with backwards compatibility (for example, if some of your APs can handle wifi6, but even just one can't, turn wifi6 off for all SSIDs that are on both models).

I’m using Ubiquiti at home (a switch and an access point) and self host the controller too.

You can disable automatic updates in the controller and then upgrade the firmware when you please.

Regarding if Ubiquiti have access to our hardware a cloud account is optional so you can just use a local login to your controller instead.

If you don’t flash custom firmware images on them that you built yourself from source code; then you have a massive backdoor that you can’t turn off. (Same goes for all other networking vendors, especially Cisco)