Privacy enhancement: enforce only allowing one border router - possible?

[flatsiedatsie]

I'm trying to create a privacy-protecting implementation of Matter.

One specific issue related to Thread is that it seems difficult if not impossible to lock down access to the internet (correct me if I'm wrong). As I understand it each additional border router means there is another potential 'on ramp' to the local network, and from there to the internet.

Can I enforce a Thread network to only ever have a single exit point? In this scenario, even if another border router gets added later, I want to somehow enforce that the new BR (who I have no control over) may only run in router mode. Even if the 'main' controller disappears for a while, the other BR may become leader, but should NOT allow internet access.

Here's a network graph of the intended situation:

Is that possible?

So far I'm experimenting with setting the leaderweight to 255.
I'm also happy to see that I can set up a BR to not allow internet access by not setting network data. But that doesn't give me any control over what the other border routers do.. right?

(This is the first issue with the word 'privacy' in the title 0_0)