For security reasons I want to see only ICE candidates with the relay type when I try to connect to openvidu. Is this only possible with a separate turn server or perhaps with the COTURN_INTERNAL_RELAY option in OpenVidu Pro?
What OpenVidu Edition are you using?
With COTURN_INTERNAL_RELAY and closing all Media ports (40000 - 65535) it should work. If you have Coturn deployed in a different machine those ports should be reachable by the Coturn instance. If coturn is in the same machine as OpenVidu, it should work just by closing those ports.