I don't think that's possible, sorry.
I'd suggest to use the managed clients (if you don't have them already), and setup a mirror inside of your network. The mirror itself would need a full access to the updating servers again, but the clients could be set up to update from the mirror only, i.e. locally.