For the cloud option, is there an agent that we can run in our network for access to sources and destinations, or does the current model require exposing everything to the Internet?

I believe there is no option to run an "agent" within your network while using the cloud version. I cannot confirm this as I am only a community member and not Airbyte employee. You may want to look at similar question here. https://airbytehq.slack.com/archives/C019WJFR1JT/p1633896212406000