You don't need the external IP addresses if the application is in the same internal network as the cluster. If using a load balancer on top of the cluster, the load balancer could expose whatever IP (external or internal - depending on the configuration), but it could theoretically only point to the internal IP addresses.

The internal and external networks can be two distinct networks. This would allow you to separate the ‘frontend traffic’ (client to DMC) from the internal traffic (DMC to shards); however, it is not mandatory to do that, and all the traffic can flow in one internal network.

References

External IP addresses can be removed using the rladmin command-line tool

rladmin node <id of the target node> external_addr remove <external address>

Refer to the document Enable private and public database endpoints