You don't need direct Internet access to use Let's Encrypt, as long as you can arrange for the challenge response to appear in public DNS under the name you want to use.
1: https://letsencrypt.org/docs/challenge-types/#dns-01-challen...
2: https://eff-certbot.readthedocs.io/en/stable/using.html#dns-...
If I remember correctly, you don't need your server to be reachable from the internet, but you still need to be able to contact your DNS provider and the LE server, so you need internet access