If they want to airgap a model, then do it properly... exposing any aspect of the Internet whether via a DNS resolver or not, is not actually blocking Internet access.