In the past, I've used WSUS 3 in disconnected mode by exporting updates from a server on the public internet and importing them to a server on a private totally disconnected network. Sophos has been used in the same way to provide anti-virus capabilities.
We're looking at a new Windows Server 2012 based network, but it isn't clear how to bring virus definitions for Endpoint Protection across to the offline network.
Are there any existing instructions available that I haven't been able to google up?