The right middle ground is running Little Snitch in alert mode. The initial phase of training the filters and manually approving requests is painful, but it's a lot better than an air gap.

that’s what I do, but since it’s in my control the security teams don’t like it. ;)