NTP configuration for a workgroup DNS server sitting in DMZ (no connectivity to internal Prod DCs)

Environment:

• A standalone (workgroup) server in our DMZ network, running the DNS Server role
• No network connectivity between this DMZ server and our internal Production Domain Controllers (isolated by design/firewall)
• Server is not domain-joined, so GPO-based NTP configuration isn't an option

My question:

Since this server can't reach our internal DCs for time sync, what's the recommended approach for keeping its clock accurate and stable?

Specifically:

1. Is it safe/best practice to point it directly to an external NTP source (e.g., pool.ntp.org, or a vendor-specific pool) via w32tm /config /manualpeerlist:..., given it's already internet-facing in the DMZ?
2. Should outbound UDP/123 be explicitly opened on the DMZ firewall for this, or is there a more controlled way to do it (e.g., routing through a proxy/relay, or a dedicated internal NTP server reachable from DMZ without full DC connectivity)?
3. Any gotchas specific to a DNS role server in this scenario (e.g., does DNSSEC validation or logging depend on accurate time in a way that's more sensitive than a typical workgroup box)?

Trying to figure out the cleanest, most secure way to handle this without opening unnecessary internet-facing dependencies on a DMZ box. Would appreciate input from anyone who's dealt with time sync on isolated/DMZ Windows servers.