20 years ago I would download testing in an isolated network with no route to the internet. There was a single bastion that had two physical NICs and no route between them. It was inconvenient, but we could run massive tests that flooded switches and there was no risk to any of our other networks.

This was a precaution taken 20 years ago when we were working with stone knives and bear skins, as our load test operator would say.

If the model shouldn’t have access to the internet, put it on a network without access to the internet.