should they remain isolated? I think that is default rules.
Why not allow them?
If you run rehips in Standard mode and you didn't remove Google from trusted publisher list then it will update normally. The file that google update spawns is signed and will be auto allowed and google will update. Never had issues with it.
Some update processes are allowed and some are isolated. Why isolated? Because Chrome may be installed in real user home profile folder. Making it isolated will copy Chrome to ReHIPS user home profile folder. So running these update processes outside the isolated environment will update real user Chrome and not its isolated copy.