That would work, and I'm worried about that, too.

They would HAVE to go all-in on it, because a single proxy "inside" grants access to everything outside (as I was fond of showing my high school friends).

But for a country that doesn't value / actively hates new business startups, restricting all packets to a whitelist is doable. Economically damaging, yes, but much much less than a full "grid down" order like we've seen in recent years in Kashmir, Tigray, Gaza etc