you don't need to airgap it. just limit the access to the specific APIs/access to the database and block everything else.

CrowdStrike won't be able to upgrade itself through your database API...