With Advanced Rebranding, you can disable the Agent to avoid anyone from accessing information locally. You can also disable the ability to delete files from the Storage tab in a backup agent (assuming you wanted to keep the agent enabled and simply prevent deletions from backup storage). You can also do things like disable editing of backup / restore plans in the agent. I think with those options, you can consider cloud backups air-gapped. If you have additional questions, let me know.

No, it's not air gapped. An air gapped destination is neither connected to the Internet or to a local network.

For example a backup on an USB disk in a security vault without any cables attached to a computer is air gapped.