What security controls does an AWS NAT Gateway enforce when provisioning managed outbound-only internet routing for workloads isolated inside private subnets? Furthermore, why is masking private IP addresses behind an Elastic IP the definitive technique to permit essential software patching while strictly blocking unsolicited inbound connections?