If you are concerned about cum ui accessing internet behind your back you can always launch it with bubblewrap.
bwrap --unshare-net --dev-bind / / -- start_comfy.sh
As simple as it can get. If you are really concerned you could limit its filesystem access too.