Manual Windows Updates

I’ve got a few boxes that I don’t want to be able to connect to the outside world (SQL, Domain Controllers, etc.), and I was wondering if anyone knew of a way to manually acquire and install Windows Updates so that I can stay current with patches without exposing them?