Heyy 🙂
Little unsure what you mean.
Parts of ITFlow require outbound Internet access to function (the updater, domain scraper, etc). You could in theory keep it completely air-gapped, accept some lost functionality, and manually copy updates across if you really wanted to.
If you just don't want to expose your ITFlow instance to the Internet for inbound traffic, that's fine. You can put it behind a VPN, or restrict the IP Addresses that can connect in UFW/IPTables/htaccess?