Can kratos be deployed for use in an intranet? Or does it have to rely on public access and be accessible by the public network?

It can with careful configuration. The SQA thing in your screenshot is an opt-out telemetry collector.

You’ll also need to disable the haveibeenpwned integration, otherwise, registration flows using passwords will never succeed, because the external server can’t be reached. You can also self-host the service: https://www.ory.sh/docs/kratos/guides/hosting-own-have-i-been-pwned-api