Deploy everything using a cloud native architecture and have all services internet facing, read about "zero trust networks" to understand more about securing such things.

Maybe there are "data governance issues" stopping the internet facing thing from happening. But if not, that's a more modern approach then three tier network segmentation.