Umbrella design query

Hello,

We are deploying Cisco Umbrella with two VAs. For improved security, I would place them one-armed into a Firewall DMZ., where I can have full control that the VAs can only reach the systems they need to reach. DNS traffic from users and servers will pass through the firewall.

Trying to wrap my head around the real security benefit of this design.

Any suggestions?