The collectors and analyzers do not need internet connectivity to get the update. When you log into the systems using a browser, it is your desktop that is connected to the internet and receives the updates on behalf of the collector/analyzer. Once you download them to your desktop from the internet, you then perform step two which is to upload the packages through to your systems. If you can log into the UI of the systems, you will be able to upload the packages.
If you have the APM Console, this your best option to update your systems. The APMConsole will need internet connectivity and it handles the download/uploading to it's components: PAE, Collectors and Analyzers.
I've shared the blog that I wrote regarding using the APM Console to handle the updates.
The link is also here: