In practice? You are issued a special, secure phone expressly for connecting to the network which is not physically connected to the internet. Many details of e.g. CsfC are unclassified; you can read the architecture pdfs.

install teams on your phone? you'll need to cave a bit and allow VPN access from the phone to the Teams server, though.