I’ve just removed the public IPv4 addresses from these nodes and only allowed them access via the NAT network. The IPv6 public addresses remain. This frees up 2 IPv4 addresses, which allows us to migrate our Jenkins controller machine, which does need a public IPv4 address.
If you see issues, please let me know.