What is the proper way to delegate to a private / hidden sub-domain?

[John Levine]

In article <mailman.366.1588797473.942.bind-users at lists.isc.org> you write:
>-=-=-=-=-=-
>
>On 5/6/20 2:29 PM, Grant Taylor wrote:
>> That's one of the hard requirements of what I'm doing.  Not doing that 
>> is not an option.
>
>To elaborate, the internal clients are in a sequestered network which 
>will never have outside access to it.  As such, the outside world can 
>never query something from a system in it.

Can clients on the internal network contact hosts in the outside world,
or is it really disconnected?