Unconstrained internet is nice, but I don't think it's a hard requirement. Just tricky to enforce, even in-person.

Presumably if you block domains, you wouldn't be able to use AI to find a way around the block. So doing so demonstrates at least some human skill

Use jumpbox to access CTF. Disable all wireless for the playing hall.