I'm not clear here if "Internet access" means incoming access, outgoing access, or neither.

To be clear, the solution above requires no incoming access. Its 100% client, there's no server access. (Client to the DNS Api, client to ACME.

If the device does not have client access to anything then the certificate can be obtained from another device. You would then need some mechanism to put the certificate on the device.

I agree that IoT devices are problematic, they either need client access to the Internet (which most don't get) or they need to run a "server" of some kind to receive the certificate updates. If you're lucky this could be automated.