Is there a tool which can be used to check which security patches are installed on a standalone (non-Internet connected) Windows machine and install any that are missing?
I don't know of any standalone tools that can do this but if you're simply on a disconnected network with server support, you can deploy an offline copy of WSUS or SCCM that can do this. There are also a number of 3rd party applications which fill the same role, such as the Shavlik family (originally Shavlik, then Patch Authority Ultimate, then owned by Dell).
You can download groups of software patches via the Windows Update portal as CAB files and import them with the WUSA tool.
I also found this link. I didn't look too closely but it seems like it might be up your alley: http://www.wsusoffline.net/