The systems im used to are used in hospitals and banks as well, they are rather a setup of closed off Mashines that can only communicate internally and a second system that gets necessary data outside, the inner circles don’t get internet at all in these setups and they aren’t connected to the outside circle, they are closed off completely. The outside communication builds on a VPN (or sometimes a physical fiber cable) to get to the necessary network (outside databases, or servers that stand in another building/facility for example) where they do their business, the computers in that circle aren’t standalone Mashines, they just start a Virtual Mashine on a server. Incoming traffic goes through a filter that is strictly white-list for all traffic, but you can’t do that as a isp (you cant do your method as a isp either) outgoing traffic is also white-list only. (yes we are assholes and block people from using Facebook at work)

Its just impossible to even start a VPN from these systems unless you have administrator privileges, so im not used to your way of doing it. Maybe some day i need to learn about that more, as things get more and more connected the systems im used too aren’t up to standard anymore it seems. I still like the airgap for safety.