ANSWER:

In principle the following might work:
Create a WSUS server and regularly

1. plug it into a LAN with internet (or internal upstream WSUS) access and sync it.
2. down and unplug it and carry it to the security lan
3. connect it there and let clients update and report

You may have a considerable delay in upgrades because it may take a few back and forth movements antil this mobile WSUS learns which of the updates are actually needed and should be downloaded.

Hagen von Eitzen from http://serverfault.com/questions/510494