NTLite requires public network access for three different functions:
- Checking for a newer NTLite version (using HTTPS)
- Checking for the monthly updates list (using HTTPS)
- Download KB updates from MS servers (using HTTPS)
The first two calls require access to licensing.ntlite.com, and the last to MS's download CDN.
Loss of #1 means you don't get reminded of new versions. But you can visit NTLite's download page to check manually.
Loss of #2 means you can't use Updates downloader, which is a handy feature. But since W10/11 have cumulative updates, other than one-off KB's, figuring out each Patch Tuesday's list takes a few minutes of browsing news sites.
Folder Subscription is where NTLite scans your private staging folder for available KB files to automatically integrate into the image. Any recognizable MSU file will be included. It saves you the effort of rescanning the Updates downloader, or NTLite's own cache folder.
If your security policy allows you to download KB's from MS's Catalog site, then save those files here. There's no subscription to any external site, and there isn't one anyway because MS doesn't provide this feed. WU works by matching your specific platform/release against the WSUS database. It's tailored for the system requesting updates.
Here are several options:
1. Edit NTLite's settings.xml, and enable the proxy server name/port. See if the security team will allow access, and they can audit the traffic.
2. Commit to manual downloading every Patch Tuesday. In reality, you basically need the monthly, and one .NET CU. Nobody really needs the Dynamic Update KB's, and 4.8.1 is too new for any vendor to require it right now.