Deploy a jump box on the third party network to access the OT environment and provide updates using a physical delivery method on the workstations

Implement a bastion host in the OT network with security tools in place to monitor access and use a dedicated update server for the workstations.

Enable outbound internet access on the OT firewall to any destination IP address and use the centralized update server for the workstations

Create a staging environment on the OT network for the third-party vendor to access and enable automatic updates on the workstations.