Through ongoing discussion with you in chat, it sounds like you're in a hyper-locked-down environment where you can't even use USBs for updates.
This adds some additional considerations. There are many methods such as apt-get download or apt-offline for obtaining updates, however since you can't use USBs it seems on the environment, and would be restricted to CDs/DVDs, you're going to run into physical resource consumption issues with how many CDs/DVDs you'd have to use for such a setup.
While it is entirely doable with apt-offline per another post's answer on apt-offline, and the (translated) blog post about using apt-offline (yes this is a Google Translate link), your primary limitation here is going to be the use of CDs and DVDs. You'd technically be burning one or more disks each time you update.
There are other still-secure methods for updating a private lab environment, however this typically will involve an opening in the 'environment' that will be allowed to communicate to a specific, dedicated system running apt-cacher-ng as an APT proxy, which can then be used as the update mechanism out to the 'net without any other data being able to traverse outbound. However, also in chat, you had mentioned this is a completely isolated, air-gapped, no Internet at all type of setup, so this approach won't work either.
If you are truly in such a restricted lab environment, then your only other update would be regularly rotating out the 'lab' computer that is involved here, and working with a cloned disk image that you'd 'restore' to the lab computer, which you'd pull from an identical system put on an Internet-accessible system that would then pull in its own updates, and then you can use as a disk image base. However, this approach also won't work if you are stuck using only CDs and DVDs; the disk image approach needs space to store the disk images, and that kind of necessitates the use of large-space USB storage.
I think the higher-ups involved here need to have a sit down with someone familiar with building secure lab environments, and discuss what exactly they're attempting to achieve in this 'lab' environment that would require such a heavily locked down environment (Government and security-clearance-needed things come to mind, but it doesn't sound like this is the case here). There are many ways, several of which I use and know as a secure setup thanks to my IT Security background and the needs of the environments at my employers' locations, to keep a 'secure' lab environment while having several acceptable methods for getting updates in a secure method. This is ultimately, however, going to end up as a logistics discussion that goes beyond the scope of this question... at least, as how you explained the environment to me in chat.
