There is a little-known feature in Coder that lets you run (and tag) separate provisioner daemons in Coder.

The basics (admin can run):

coder provisionerd start --tag environment=onprem

Then, a template can be created for a provisioner only with the tag

coder template create --provisioner-tag environment=onprem

Alternatively, a new template version can be pushed that requires a provisioner tag

coder template push <name> --provisioner-tag environment=onprem