Adrian had the best thought for the updates. We currently use that model. Both MS SUS and Mcafee's EPO are both programs that run on a server, and not necessarily a desktop that someone would log into. The point of those servers is to act as a central lone server that would retrieve the updates for a multitude of pc's behind your gateway. The pc's would download their updates from those servers. Another good thing about them is that they keep track of your machines that are not up to date on your patches and Dat files. The EPO server also keeps track of virus's that hit your machines.
If these two aren't available or still aren't an option, you can always set up one of your Citrix servers to download it's updates and then store them in shared UNC path so that your pc's can retrieve from there. This way your still only letting your Citrix server surf the net. Since EPO isn't free, this is the cheapest route to go. Also note that MS SUS is free for now............
hope this helps.
