SecurityOnion/Ubuntu Repo for Offline Updates?

 I am back at it working on a solution for updating multiple instances of SecurityOnion that are disconnected from the internet.    In previous tries, I was using Apt-Catcher-NG and from the looks of it SecurityOnion 2.0 uses Apt-Catcher-NG for its offline updates, but I need to see how this would work for multiple single instances of SecurityOnion.  

Aside from that, I think I would need a 2nd machine as the actual machine that touches the internet.  This machine would be the "update" machine where all the patches are downloaded, and then burned to the Primary SecurityOnion repo maybe?   

I would need some way to hash the updates that are transferred over from the internet machine to the "primary".  Is there a way to send patches over a one-way tap and received at the other end?  Guess its time to do some more research.