In the past, I've used WSUS 3 in disconnected mode by exporting updates from a server on the public internet and importing them to a server on a private totally disconnected network. Sophos has been used in the same way to provide anti-virus capabilities.
We're looking at a new Windows Server 2012 based network, but it isn't clear how to bring virus definitions for Endpoint Protection across to the offline network.
Are there any existing instructions available that I haven't been able to google up?
There are download links for System Center offline definitions in Step 6 of this Technet article:
http://technet.microsoft.com/en-us/library/ff823818.aspx