Updating disconnected systems

Hello,

A few years back I set up an offline certificate authority for our organization's email and VPN client connectivity. That box is currently running Devuan Daedalus, but I am growing tired of all of the microsoft creep into Linux. On top of grub, network manager, windowsd, and other junk, it seems all of the distributions are now requiring one to adhere to someone's idea of mount points (AKA usrmerge) so I am not looking forward to the next version requirement with even less freedom of choice.

I run several FreeBSD servers with no issue (and a huge thank you to all of the wonderful volunteers that make FreeBSD such a joy to work with!). I would like to migrate the CA box to FreeBSD, however the CA is fully isolated. I am not as well versed in FreeBSD updates as I am with APT, and am looking for information on how to keep a completely offline FreeBSD box up to date.

I figure can use Poudriere for packages, but that doesn't work for the core system as far as I can tell?

Appreciate any pointers or documentation that can get me going.

Regards,
Pat