If you are concerned about update checks (all qubes check for updates by default), run the following on the qubes running outside the VPN chain:
qvm-service <qube> qubes-update-check off
4 Likes