Best way to update standalone PC
We have a secure network with no internet access. I want to keep the PCs up-to-date,what is the best way to patch them?
I was thinking of having an identical build on the main network with access to the internet. Then I can test the patches and copy the patches over - is there a way to store patches downloaded (so I can stick them on a USB drive) and copy over?
All machines are Debian.