Probably the best solution is for you to put a spacewalk or satellite server in the secure zone (or at least accessible to the secure zone) and publish a channel for that server type.
You can download the dependencies and the package rpm, sneaker net them over to the server on a thumb drive and install them with an rpm -i in the order dictated by the dependency tree, however you'll be doing that every time you do patching, upgrades or installing software, so it will get old, fast.
If you install the Sat server, you can load all the software any of your instances need in an internal repository, giving you control over the packages available for installation while simultaneously largely automating that process. You just have to go to the target instance, wget the channel and yum upgrade all.
Here's
a wiki I've used in the past for this specific purpose. Take a look, if you still prefer to sneaker net it (or for security reasons that's all you can do) post back and I'll hunt up some instructions for determining the dependency tree and installing xinetd via rpm, but if there was any way I would swing it, I'd use the spacewalk (Satellite) server.