I would say 6 because your connection to the database is over the TCP protocol. I have no experience with this setup but you might get some help from Mendix or other people on this forum
Another option is a broker that publishes a secure web service that is running in the on permise network, this broker would then connect to the local database. This broker could even be a Mendix app. This way you could also use a asynchronous integration in the case that it is not allowed for any other app to connect to the network (not even a secured web service). In this case the broker app would periodically update the cloud app.
I would go talk to the administrators and security officers of the local network to find the best solution.