up2date enterprise-wide

[Gerald]

I have an environment with 40 servers. Whats the best way to roll out O/S 
and software upgrades with these requirements?

1. systems lack internet access.
2. would prefer that generally all systems maintain the same O/S and 
software levels.
3. when considering an enterprise-wide update, would prefer to roll out 
upgrades to a subset of servers first before doing so to all of them.

It's not clear to me how to deal with this. Ideally i'd somehow maintain a 
server that contains all the updates and my systems that do not have 
internet access could update from that one (it *woud* have internet access).

Thanks