But I was wondering what is the windows recommends as the offline
There are several ways to keep your Windows updated, without all of them being connected to the Internet. There are Microsoft provided solutions (WSUS/SCCM), as well as n-number of 3rd party products available which support the same.
You can download and install the Windows Updates (patches) manually on the system, but that would be terrible to manage if you've more number of systems and you want to do proper testing of the patches in the UAT environment.
Another option is to setup a WSUS Server, which would synchronise with Microsoft's Update Servers for the latest updates, and then you can distribute these updates within your intranet/network without requiring any of the other system to have Internet.
Then there are some paid solutions like Microsoft's SCCM(which also uses WSUS), and couple other 3rd party applications.
I want to control every single patch and update that is installed on
these offline slaves.
If this is the only requirement, and if you don't want to invest a single penny, I'd suggest you to go with the deployment of
WSUS. You can enable WSUS role on any of your Windows Server OS.
WSUS Server would require to connect to Internet to synchronise with Microsoft's Update Servers for the latest updates, and then you can distribute these updates within your intranet/network without requiring any of the other system to have Internet.
Using WSUS, you can deploy updates in your UAT environment first, and then depending on the outcome of the patch, next to your production systems or similar. It has the options to select updates for products (Microsoft Office, Windows OS Types, etc.), and the classification of updates(Critical Updates, Security Updates, Upgrades, Service Packs, Updates, etc.) which is pretty much handy to use.