Yes, that's it exactly. I've set Bart to not automatically initiate networking (I can explicitly start it if I want to; so far, I haven't) and I don't use session-time updating at all.

So, each time I want to scan a batch of systems, I build new Bart .ISOs; a DVD-size one containing additional tools, offline SPs, patches software pre-installs etc. and a CD-sized one stripped to the essentials.

The build process starts with updating all the scanners, getting any new versions of common edge-facing software for the DVD .ISO, setting new wallpaper and UI button colors so I known I'm not booting an old disk, and updating the Version line for the build. Once done, I point to the appropriate Include and Output subtrees and .ISO name, and crank the handle.

The other approach is to keep all the volatile stuff off the boot optical disk, e.g. on a write-protectable SD card via USB card reader. The problem there is linking the Bart UI to the relocated apps, and predicting (or discovering) the USB storage drive letter at runtime.

I need to do this because my Bart project is maxed out for CDR space - but it's such a shlepp, bah.