You've recently deployed Compute Engine instances in the us-west1 and us-east1 regions within a Virtual Private Cloud (VPC) utilizing default routing configurations. However, your company's security policy strictly prohibits virtual machines (VMs) from having public IP addresses. Your objective is to enable these instances to fetch updates from the internet while safeguarding against external access. What is the most appropriate course of action?