If you really wanted to sandbox a machine you’d offline cache the packages and not give it any physical route to the internet, not via a jump box, not via a proxy, nothing.

This was poorly executed.

DMZ - https://en.wikipedia.org/wiki/DMZ_(computing)

Unplug the ethernet cable leading to the outside world, then?