Separate point from the HVAC side. That plug sits in your server room and can switch a load there, so treat it like any other device with access. Keep its profile TLS only, give it its own profile instead of sharing the sensor one, and put your office’s public range under Allowed networks so a copied token from that plug is useless anywhere else. Cheap plugs get opened up and dumped more often than people think.
Measure twice, poll once.