The Configure a Disconnected Network to Receive Updates chapter in the WSUS documentation describes the officialy supported way to use WSUS in a disconnected environment. You need to have a second WSUS installation which can download updates from Microsoft servers.
First you need to synchronize the metadata on the connected WSUS server; then you must make it download the update files in some way (e.g., by approving updates for some dummy group). After doing this you need to export metadata from the connected WSUS server:
wsusutil.exe export packagename.cab logfile.log
packagename.cab and everything in the
WsusContent folder to the disconnected WSUS server, and import metadata there:
wsusutil.exe import packagename.cab logfile.log
Wait while WSUS validates the update files, then work with it as usual (approve updates, etc.).
The main problem with this workflow is that there seems to be no way to transfer approvals between the disconnected WSUS server (where you can see what updates are required by clients) and the connected WSUS server (where you need to download updates).
Also see this article, which describes a recent update for the WSUS server; this update removes the 2 GB limitation on the export file size, which can be exceeded if you synchronize updates for lots of products. The update changes the export file format from CAB to gzipped XML, which does not have a 2 GB limitation.