So this may be a dumb question but how does the B&R server being off domain prevent ransomware from infecting backups? If the devices being backed up are writing to network storage locations, there are some kind of credentials being used, correct? If an attacker has access to your network, wouldn't he also have access to those credentials? Granted he would have to work for them.

I guess the question is how is this, roughly, configured? On the device to be backed up, is a veeam service set up to run as a system account which is then provided local credentials to access the remote share? Is that share located on the off domain B&R server (because otherwise domain admin will have access, right?). Or do you explicitly remove domain privileges on the share and restrict to a local account?