It depends on how you want the patches to come over.
If you want the appserver to directly pull the patches and cab files from your helper system, then you need an agent on the helper and the appserver needs to access it.
otherwise you need a way to copy all the patches and cabs from the helper to a system (w/ an agent) that the appserver can access.
I want the patches to be pulled down to the helper system and then accessed as needed when I run the patch analysis jobs.
I'm guessing the helper system will need to have nsh installed.
You should put the agent on the helper system. I don't think the windows downloader needs nsh.