Earlier quoted context omitted.
AGPL doesn't require releasing internal changes unless the changed code is served (like in SaaS) externally. Organizations are free to internally modify, run, and distribute changes to AGPL code as long as the modified code is made available on the internal network.
Im generally curious, what's the definition of "externally"? It's a bit more vague compared to "operating as a service", since you may expose your service externally, but only allow access to internal users.
If you let someone "external" to the company use the software over a network, then, during their use, they should have a way to get the source. If you don't let any one "external" connect to the service, then there's no need for you to provide them a way to get the source.
-----
For example, if there were a software like redis, but one that were licensed under the GNU AGPLv3 — say 'gredis' — and you let someone connect to it — say, using 'gredis-cli' — then you must make the source available to them. But if you run this 'gredis' software in your stack and make use of it in your stack but don't let anyone except your ops team connect to the running 'gredis' instances, then you need make your source available only to your ops team.