Answer
IFS officially supports two network models for remote deployment: unrestricted outbound internet access from the middle-tier Linux box and Windows management server, or a fully airgapped installation — anything in between (like routing outbound traffic through a company's own internal proxy) is the customer's own responsibility to configure correctly, since IFS doesn't provide or require a proxy itself; the documented proxy-install steps exist specifically to make the IFS installer/connection work correctly when a customer already has such a proxy in place, including specific PowerShell setup on the management server. If you instead restrict outbound traffic via a firewall rather than a proxy, you need to explicitly whitelist a documented list of required addresses (including Ubuntu security-update servers for the middle tier and the DB server's own OS security-update source, e.g. Oracle Linux's yum repository, in addition to the core IFS endpoints), and still separately handle Windows security updates for the management server through whatever mechanism your organization normally uses.