Gotcha! Another approach could be to set up the watch for a guest wifi / vpn routed access point?

That's what I do with mine. It means I can use the Garmin website for stats, get updates, sync / plan routes - but not have it connected to my phone, only connect to specific wifi when I allow, and only use data I agree to with Garmin's variois policies.

Obviously I dont get any notifications from my phone / weather, but that's not something I care for.

You'll need to find someone sharing the gupdate.gcd file for firmware 21.22. You can drag and drop those onto the watches storage.

Alternatively, use the desktop app to install ovwr USB?

They might not be blocking plex, but blocking most ports that aren’t relevant to “normal” internet usage. E.g. just have ports 443, 80 and 8080 allowed.

You might have to steer a VPN through those ports too?