I corporations start planning this, then the first question would be, can this be piloted? And small group of users be covered by this, while others are still old process.
Next question is, could you clarify your statement: "All SfB Front Ends must have outbound access to the internet" a bit? It is quite normal that on-premise systems are behind multiple firewalls and the only option to go out are the proxies. How we could show to the Front Ends to the correct route to internet? Also, when the proxy is the only gateway, that makes external name resolution to less important as no direct connections are allowed. For your background, I have used netsh winhttp proxy today, but at least "LS Storage Service" does not fully respect that.