Whitelist for air-gapped container registry pullthrough?

Hi everyone

I work in a big MSP that does government stuff and has a strict(-ish) airgap policy. In this company, containers are considered a new and experimental technology. People are starting to realize that Kubernetes might not be all that bad and while they constantly dunk on it for being complex and vulnerable because of containers (lmao), all the managers also want their own cluster. We have a kafkaesque bureaucracy around getting access to our internal container registry. When you finally get a service account for a read-only user, you also get a repository with full access to the docker registry etc. I think my colleagues have a point that it seems wrong to just have unfettered access to docker registry.

I have two questions for you guys:

1. Does anyone know of a publically available whitelist needed for running the most common kubernetes components and containers? I suppose registry-1.docker.com/library/* is pretty important and acceptable to whitelist. Any other suggestions?

2. Would it be bad from a security perspective to set up an endpoint where authentication isn't required (only accessible from internal networks) where people get pull access to whitelisted projects in the common registries? I think it would be more foolproof and easier for people to do PoC work if it was just accessible by default. If they need more than that, the operations teams can set up their own thing.