During registration the customer should be asked whether their osd cluster will be for public or private kafka instances. If private the managed kafka agent resource provided to the data plane should contain:

spec:
  net:
    private: true

This must be provided in the initial spec of the agent as data plane won't initially include any logic that allows for toggling this value.