The only way to get AV and DAT updates to a MEG that is not allowed to access the Internet would be to integrate it with ePO.
Spam signature updates and access to the GTI cloud (IP and message reputation) still require Internet access. It is possible to configure MEG to do so via a proxy server if necessary.
You can find a more detail discussion about this topic on our FAQ.
Hope this helps.