You run a pull-through caching proxy deep enough to give it a simulated internet, like archive.org with mock APIs. Anything it requests, it will block while a fake version of that site is created and run offline.

This stuff is really not that hard, which is why it is so unforgivable to get it this wrong.

Sure, doing it right would take a bunch of tokens, but I bet they have enough.

The hugging face incident involved disabling the usual model safety mechanisms in order to test hacking ability, not model safety. Not being attached to the internet in that case seems obvious.