Matter relies on multicast DNS to discover commissionable devices, and typically if you have a separate vlan or subnet, these multicast packets don’t survive passing through a router to get to HA. Routers can often be configured to forward mdns, but each routers’ settings are different which is why separate vlans are currently discouraged.
I have deployed several Matter-over-WiFi devices to an isolated vlan with no internet access, so that’s likely not the issue, but my HA server has a second NIC on this vlan so it can receive the mdns packets.
My understanding is the Matter server downloads the DCL (potentially from Nabu Casa, since they are a member of the CSA), not the end device or the commissioning device. At least that is how my iPhone worked, maybe Android is different.
AFAIK if you use apple gear you auto magically make use of the vendor cloud - are your certain your apple phone was offline when commissioning? (maybe it had a mobile connection)
Same for android, then it’s google cloud and no apple cloud
FWIW, I just commissioned a Tasmota Matter device with my cell radio disabled, only private WiFi and bluetooth, no issues . Again, my Matter server is dual-homed, so it can fetch the certs:
peter@felix:/opt/matter/data$ grep -i dcl matter-server.log
2024-09-30 13:42:48.828 (MainThread) INFO [matter_server.server.helpers.paa_certificates] Fetching the latest PAA root certificates from DCL.
2024-09-30 13:42:50.688 (MainThread) INFO [matter_server.server.helpers.paa_certificates] Fetched 63 PAA root certificates from DCL.
2024-09-30 13:42:51.811 (MainThread) INFO [matter_server.server.vendor_info] Fetching the latest vendor info from DCL.
2024-09-30 13:42:52.154 (MainThread) INFO [matter_server.server.vendor_info] Fetched 247 vendors from DCL.