tbh I personally wouldn’t expect/suspect this to be using any of the flavours of govcloud for mass-market flavours (because that has implications on staff hiring etc)

the easy way to handle this is to have a backend/frontend separation with baseline access controlled simply by construction of routing and zone primitives. it’s relatively simple (albeit moderately involved) to do this on most cloud providers

they probably do. I worked for a content-as-a-service company that had a contract to deliver our product, airgapped, to a three-letter agency on a regular schedule, and we were a tiny company. Microsoft's biggest customer is probably the U.S. government; I'd be shocked if they don't provide an in-house airgapped set of full Azure services for the entire intelligence agency system.