Storage Gateway (FileGateway) Security & Direct Connect

A customer is looking to implement Storage Gateway (File Gateway) but has some concerns around security and keeping all traffic away from the internet and going via their DX connection. As per this document https://docs.aws.amazon.com/storagegateway/latest/userguide/using-dx.html it looks supportable but wondered if we have any best practice guidance or if there are any known pit falls (ie does any traffic still go via the internet etc)?

thanks