Is there a way to do the initial block download over clearnet and then switch it back to private once finished?
Yes, you can do this. In fact, it’s the default behavior.
A fresh installation of StartOS and Bitcoin Core will download blocks from peers connected to over clearnet.
The setting you’re looking for to then disable clearnet is in Config → Advanced → Peers → Disable Clearnet.