It connects to all the configured devices, plus syncthing project servers, which do not also act as TOR nodes. If you disable relaying (or configure one manually, which is “clean”), you should be good. Better, though likely not practical solution: Tell your it department to drop that “security” policy or whitelist syncthing relays: https://relays.syncthing.net/