The Internet of Things (IoT) enables critical services in smart urban environments but remains vulnerable due to fragmented security frameworks and the constraints of heterogeneous devices. This paper addresses these challenges through a systematic PRISMA-guided review to identify and classify security strategies aligned with real-world deployment needs. A four-domain taxonomy is introduced, encompassing authentication, encryption, secure communication, and orchestration architectures. Through comparative analysis, the study highlights persistent barriers, including runtime inflexibility, cross-layer fragmentation, and limited edge enforcement, while evaluating scalable solutions such as decentralized identity, AI-driven anomaly detection, and post-quantum cryptography. A challenge-driven research roadmap is proposed to guide the development of resilient, regulation-compliant, and context-aware IoT security frameworks for urban healthcare, energy systems, and smart mobility.