The relevant env vars to disable are:

Disable silent phone-home for usage tracking:

    MM_LOGSETTINGS_ENABLEDIAGNOSTICS: 'false'

(The fact as to why marketing spyware is termed "diagnostics" is left to the reader to discover.)

Disable silent phone-home for version freshness check:

    MM_SERVICESETTINGS_ENABLESECURITYFIXALERT: 'false'

Grep the released binary for 'api.segment.io' if you don't believe me. I use a Dockerfile along the lines of:

    FROM mattermost/mattermost-team-edition@$$cap_mattermost_version
    RUN sed -i 's#api.segment.io#xx.example.com#gI' /mattermost/bin/mattermost
    RUN sed -i 's#securityupdatecheck.mattermost.com#xxxxxxxxxxxxxxxxxxxxxx.example.com#gI' /mattermost/bin/mattermost