Endpoint Protection in a closed network

Hi 

I have a customer that wants to run SEP in a closed network, there is no internet connection even for the SEPM. They have suggested they want to manually collect signature updates and manually load on to the SEPM for distriubtion to clients, there is network connectivity between SEPM and clients.

Is anyone able to advise if this manual process is possibe?

Best,

Simon