We were/are looking at deploying a WSUS staging server in our gateway environment that downloads patches from Windows/Microsoft Update and then our internal WSUS servers obtain patches from there.
...