At my previous job, I was working for one of the 10 largest defense industry companies. I can answer from that perspective.
The bulk of my work was unclassified. That means I did it at my desk, in my cube, in the main part of the building. The computer that I used was on the corporate network, which was connected to the Internet. However, there were times when I had to enter classified parts of our facility and do work in a secure environment. However, the bulk of this work was systems integration and system testing using real-world data. The system had already been designed, coded, unit tested, and some level of unclassified system testing using mocked up data.
In the classified areas, there were some workstations with access to the corporate network. However, these workstations were typical office machines - no development tools. That means no version control, no compilers or debuggers, and so on. These were in a shared table. You would have to lock your classified workstation, get up, and walk to one of these shared computers, use it, and then go back to your classified workstation.
That said, there were some projects where the software is classified, so the work also needs to be done in a classified environment. These people will be doing software development on machines that don't have access to the Internet and may need to physically move to a different part of the room or even a totally different room to have access to the Internet.
From a coding perspective, one of the hardest things in this environment is the strict configuration management of the environment - using specifically approved software packages and even specific versions of those packages. Introducing new software to a secure environment is extremely difficult. Although this is true in any regulated environment - although I'm out of the defense world now, I'm in healthcare and we still have a pretty strict management of the configuration of the environments. Something that I'd like everyone to understand is that if I'm working in one of these environments, I'm probably not using the latest and greatest set of tools and technologies, but what's been approved. Answers directing me to upgrade installed packages or patch any kind of shared configuration won't work.
The second hardest problem isn't just for Stack Overflow, but any time there's a problem. Sometimes, problems only exist in a classified data set. More than once I've passed my full battery of tests, but found that something in the classified data set wasn't right. Sometimes, the data deviated from the specification. Othertimes, I had overlooked something. Having a function and not being able to show people the input to it and output from it is generally difficult. Things like this are hard for Stack Overflow to deal with - this really requires discussion.
As far as policies, nothing really prevented me from using the information on Stack Overflow. But then again, I never copied code from Stack Overflow into my work projects, but used it to better understand the problem and how to approach a solution. I suspect that the current licensing of code on SO would be a problem for major companies to fully grasp. However, that is only an issue if copyrightable code is being dropped into projects. Highly unlikely for these secure projects, unless people are hand-carrying SO answers into classified environments.
If there's anything I'm missing or need to elaborate on, please leave a comment. I'd be more than happy to help any users or Stack Overflow staff better understand working in regulated environments - I spent 5 years in defense and now just over 6 months in healthcare.