Hierarchy behind firewalls

Ok so we have approximately 20 computers that will be on a firewalled network. I was asked what is needed to get them patched and software.

So searching here got me to where a user posted a link to a doc that shows...

Initial connection Notification Server to client

• UDP 138 (NETLOGON)
• TCP 445 (MS DS/CIFS/SMB)

Initial connection Client to Notification Server (after Service Starts)

• TCP 80 (HTTP) client download
• ICMP Type 8 (PING) package server speed check

ok so here is my question.. I dont know much about firewalls but if we place a package server behind the firewall (im told there are 2 firewalls but both networks will talk to each other) what do I need to get those computers patched/updated?

Will a package server work for this or would a Hierarchy be needed (something else I have not done before)

Thanks guys!