Software needs to be updated though, certificates need to be checked and all that. That's only possible with Internet - unless you run your own CA, Package Mirr

Software needs to be updated though, certificates need to be checked and all that. That's only possible with Internet - unless you run your own CA, Package Mirror on the local network. That said, there is also a trade off between having a having ports open for REST vs. having a gateway (whether that's on the local network or on the Internet). Also it's probably a difference whether one plans to update the installed system every now and then or whether that should be fully automated...