People owning the IoT devices need to be able to make transactions (with the data).
My question is, do the IoT devices need to work as nodes? As in, have all the ledger data?
Or is there a way for the ledgers to be outside of these devices?
You can solve the issue in two ways: first of all, you can make the IoT a peer node, so that the IoT needs to be more powerful in terms of processing and the internet connection more stable.
Or the IoT and the node remain separate. The IoT sends data via sms/3G to the node, which then saves it on blockchain.
If so, How do you authenticate that the data belongs to the specific IoT devices?
How do people make transactions claiming the device belongs to them?
In this latter case, you can assign the IoT an unique ID and, on the blockchain, you save not only the data, but also the ID of the IoT device.
As for how can people can "claim the device", you can also associate to the person the property of the object's ID.
Hope I was clear enough!