Most the time when deploying the 1st server in the network, the internet connection is not yet up my WSUS servers to serve its purpose, however as per project tender requirements, all of the servers, especially the Domain Controllers must be installed with the latest Security/Critical updates being even getting live. So for those who want to download individual Windows Updates, here’s a simple on “how to” download it from the Windows Update Catalog – usually for testing purposes or patching isolated networks.

https://support.microsoft.com/en-us/help/323166/how-to-download-updates-that-include-drivers-and-hotfixes-from-the-windows-update-catalog

Example: Search for Windows Server 2012 R2 March 2017 Updates.