What are the best patching tools for completely air-gapped Windows networks?

Ivanti Security Controls can handle this workflow well. You can download the patch database and required content on an internet-connected system, transfer it to the offline installation, scan the isolated machines, and export the results. Those results can then be moved back out, used to download the missing patches, and transferred back for deployment. It takes some media handling, but the process is established and automatable.

BigFix is worth evaluating if you want a centralized enterprise-grade solution. The important thing to verify is how its export and import process behaves in a completely disconnected environment, including whether imported content requires manual changes or additional approval steps on the isolated side.

For a truly disconnected network, WSUS export/import combined with PDQ Deploy and Inventory is already a solid approach. Cloud-based patching products will not help unless you can provide some kind of controlled outbound connection. BigFix is probably the strongest fully on-premises alternative if you want one console to manage both Microsoft and third-party patches, but it may be more platform than you need.

ManageEngine Endpoint Central has documentation for patch management in closed networks and may be another option to compare. For a setup limited to removable media, focus on how easily each product can export inventory and scan results, download only the required patches, verify transferred files, and import everything without reconfiguring the offline server.