An air-gapped set of servers performing updates from a non-air-gapped WSUS server are not air-gapped servers at all. If the WSUS server were also air-gapped, t

An air-gapped set of servers performing updates from a non-air-gapped WSUS server are not air-gapped servers at all. If the WSUS server were also air-gapped, then you're in the business of manually downloading each update, verifying it, and copying it to over to the air-gapped WSUS server offline. Microsoft's Windows Update servers have also been compromised in the past. Depending on the level of security you're operating at, taking new windows updates on your air-gapped systems may require having someone decompile and review each update. In general, being air-gapped prevents infinitely more exploits than windows updates could ever possibly cure; that is, until one of your admins uses his admin privileges to disable the USB port restrictions for 5 minutes that one time to copy that one file quickly so he can go home for the day. For this, there are epoxied USB ports.