That's exactly what we did in the end—used a commercial VPN and provided internet to the device over the USB cable. Could have probably used a Tailscale on a VPS somewhere too.
But I suppose, in this case Apple is deliberately using the wifi signals, not relying on IP so "just use VPN" doesn't work.