Debian package management doesn't have to rely on an internet connection. You could have the source of the security updates be a cd or USB stick or something with no problems