Try Transaction Pro:
https://www.transactionpro.com/importer-for-online
You can map any spreadsheet and import into QBO as just about any type of transaction or entry. It can do time activities and I would assume it can import all of the data that you are talking about.
But, T-Sheets is really the way to go if you're looking at an all QBO solution. Hopefully, that's ready soon for you.
Also, you could take a look at integrating https://www.bigtime.net/ for firm management. It's a fairly comprehensive solution and has great firm management (project and time tracking, billing, staff assignments, etc) and WIP tracking tools for service firms like architects, accounting/bookkeeping, and engineering firms.
You have to be careful because without more specific information I can only guestimate.
But say if you had a system like BigTime for timesheets, that isn't hosted on-prem or in a private cloud, but it shouldn't contain CUI. That is fine not being certified in my opinion.
However, CMMC is new so they could take a different viewpoint on this. My experience is primarily with FedRAMP and I haven't seen this be an issue in multiple engagements.
You can also have something like AWS Managed Active Directory that would technically not contain CUI, but you're using for authentication and identity management, GPO and such as well. Something like that would need to be certified (FedRAMP Moderate) and in this example case it is.
Even something like Office 365 commercial can be considered non-CUI if you put in the proper rules, procedures, and such around it to ensure that CUI never enters into it.