Block tracking domain by IT Department

I have received an inquiry from our IT department. They have asked if they can safely block B&D domains (such as image, app and tracking domain) that were setup in the B&D implementation process. They face issues when it comes to an unsafe CSP implementation, the redirecting that happens under water, missing referrer policy header, missing HSTS, x-frame options is not deny or same origin.

As these domains are not used to route contacts to, the same way you route a contact to a regular landing page (secure landing page on a microsite configured in ELoqua), I understand the question from IT. But I am afraid this also breaks the B&D implementation.