IP exposure depends on the service installed.

Bitcoin Core can be configured for clearnet, or Tor only, or Both.

Nostrudel has no such options and exposes real ip always (according to a response I saw a while back from the creator).

So my theoretical solution is a managed switch.