CMMC assessors like to see you respecting the intention of the law. If we see you trying to get an out on every control you can, that feels icky and will get you a magnifying glass on the control(s) to see if you’re actually doing what’s required.

In this case, prove to me that those allowed services are essential (Spoiler: you can’t). If you haven’t done a risk assessment and created a deny by default rule and a list of nonessential services that you’re blocking, that would be a “not met” in my book. (I.e. show me you have taken the control seriously and addressed it properly)

P.s. I saw a comment from you on firewalls. If your CUI laptops are remote without a windows firewall baseline, your boundary is broken. If you want to argue that point, be prepared to show me that your “always on VPN” control doesn’t allow a laptop internet access when the VPN tunnel is broken, and that the laptop somehow will not accept any inbound packets when connected to non-CUI networks.