AirGapping

Hello, Everyone.

I have a client trying to airgap their data. 

They have some data currently backing up to tape at an off-site location.

I know having a backup offline on tape is a type of airgapping but they are looking to sever communication between the production media agents and DR media agents whenever replication is not ongoing.

I know commvault has some scripts and workflows to create these, but i am looking at doing a one-way firewall configuration between the production media agents and dr media agents, using the DR media agents as the source and prod media agents as destination, so that connection can be established from only the remote site.

Does that make sense? i would appreciate any advice i could get.