Understanding Compliance Between Microsoft 365 Commercial, GCC, GCC-High and DoD Offerings

Continued GCC Data Enclave (Export Control/US Persons)

OK, so there is a small risk that Foreign Nationals could access Export Controlled data.   "Certain government entities extend beyond the accreditation with regulations such as CJIS and IRS 1075 that require screened US Persons to support the service." This risk is acceptable for other organizations requiring US Persons (CJIS and IRS 1075) but the risk is too high for Export Control? 

If LockBox is enabled does that mitigate most of the risk for accidental access to data by Foreign Nationals?