What is the proper way of providing the client machines with the needed updates and the firewall with access to update their malware signatures in a high secured network where internet access is not provided to the firewall and the client machines?
in internal device is setup to provide those updates. and the clients on the secure network go to the internal device for those updates.
like for windows, one could use Windows Server Update Services (WSUS)
Secure file transfer: that's where you have a system where USB drives are created and tagged with the secure file transfer system, then they are checked in at a kiosk prior to installation on the endpoint. If the endpoint has an interactive OS, the kiosk can be a service running locally that blocks untagged USBs or tagged USBs whose contents don't match the file manifest. For headless devices, a hardware kiosk would serve that function at the entry point to the secured area.