It won't diode allows current in only one direction. So does data diode. It is big design constraint. But that is how you truly isolate a system.

In most cases you wouldn't need TLS. You would have something like physical secure conduit or entirely secure room. If someone gets to either end of the link you are compromised anyway.

Nothing is supposed to ingress, that's the point. You'd do a TLS exchange with the proxy on the outside of the protected network. Then proceed as normal.