Building a private network with MQTT

I’m getting ready to deploy some nodes and start testing. Very exciting!
All of my devices will be configured as LOCAL_ONLY.
All of my channel names will be unique except for “admin”
All of my channels will be encrypted.
Most nodes will use CLIENT role and will have Internet/gateway.
The goal is to send all data -sensor-telemetry-mqqt to a private MQTT broker on the Internet.
The intent is to use the Internet as a primary route and use the Mesh as a secondary route, with the intention of reducing mesh traffic, and providing redundancy and resiliency, especially in the event of a disaster or a wide area outage.
All node’s channels that have Internet will have uplink enabled.

Does downlink need to be enabled to receive a MQTT Broker QOS1 Ack?

LOCAL_ONLY will prevent my nodes from rebroadcasting other nodes on the same frequency. Will my encrypted channels be rebroadcast by other nodes?

How does the flooding work on MQTT messages? If a node with Internet access receives a MQTT messages and forwards it over the Internet gateway, does that node stop broadcasting the message even if the hop count has not fully decremented?

Does every node that has MQTT enabled that receives a MQTT broadcast message, forward it to the Internet/MQTT Broker? Multiple copies of the message sent to the Broker? How are multiple ACKS handled in response to a single message?

In the flooding protocol, is there some type of RECEIVED message that is sent by the recipient (To node) that is broadcast, which signals all other nodes that the message was received and they no longer need to rebroadcast? Or do they keep broadcasting until the hop count is reached?