This. Most app servers need to be isolated from the internet anyways so any license servers for activation or metrics or whatever needs to go on premises. Same thing with mail engines, is usually a few outgoing ports, heavily warded for the mail ip and everything behind all the opSec tools they can muster

Even AWS and GCP have on premises deployments were you basically create your own mini local region for banks and such

Outline for your own VPN. You can even try it for free in tandem with Google cloud