I was being lazy, but stepping through the code the old onebox can allow this with using the allowed_domains on the generic onebox e.g.
Onebox::Engine::AllowlistedGenericOnebox.allowed_domains << hostname
preview = Onebox.preview(url, onebox_options).to_s