【server protection】Intranet servers are not allowed to access the Internet, how sophos central delivers policies and soft version updates?

Hi Hongbo,

While it is not possible to entirely air-gap your devices from the internet, we suggest using a Message Relay/Update Cache for this purpose. By deploying a Message Relay and Update Cache on your environment, one server will act as the proxy for Communication to Sophos Central, the server will also host update packages for the rest of the devices on the network. 

The following techvid on the topic help explain this in further detail. 
- Sophos Central: Configure Update Caches and Message Relays

In this setup, one server on the local network will need to have access to the internet. Others on the network will connect locally to this internet-connected Server for updating and Communication. 

As Qoosh said, the Message Relay and Update Cache feature is what you seek; we did some Government work some time ago with stringent requirements such as your client's, and the solution (in their case) was to implement a special DMZ and place the update/message relay system there, and implement very restrictive firewall rules between each zone to meet their compliance requirements.