It's teoretically possible if your vigilant of able to force users to use your published workflow to run windows with purely onprem resources but it's not the path of least resistance.
MS have done a good job of tying everything into a big entangled system where it's hard to disentangle any of the "on prem" products like windows and office offline from the cloud backend used by office365, and a lot of this is introduced gradually with standard(often security critical) updates it gets used without a lot of policy.
You can backup the office365 data elsewhere(were using aws s3 buckets for office365 backups where i work) but that's not cheap nor particularly easy to do and the need to do so is often overlooked when the contract for o365 is signed.