we will be using TF for private cloud with VMware. The issue of the internet connection is real with Docker containers. However, there are workarounds. One of your VM that you provision will have to have a Docker private registry with the images you need to pull when you provision all the other nodes etc.
You'll need to orchestrate this... It might not be immediate etc.
However this begs the question of updates and upgrades. Where would you pull them from? Everything becomes more cumbersome.. again I understand the private enterprise.
you might need to use a beachhead system that has internet connection pulling the images and allow the rest of the cluster (with no internet connection) to see the beachhead system and pull from it...
just a suggestion...
all the best