Good idea JSteskal. Thank you for bringing back the vivid discussion on a solution oriented path.
This one might help.
https://github.com/microsoft/winget-cli/discussions/1554
Eventually combined with
https://www.heise.de/download/product/wsus-offline-update-ct-offline-update-38170
but unsure if offline WSUS still works with Windows 11.
I am still with the opinion that PowerShell is still the best way. Proposed pswindowsupdate module earlier and can confirm in production it works very very well also in disconnected scenarios.
https://www.powershellgallery.com/packages/PSWindowsUpdate/2.2.1.5
Winget does work with Delivery Optimization but it will not handle differential packages. UUP?
So pswindowsupdate seems the best way as it would work natively with Windows Update Stack, just as Azure Update Manager does.
Hope this is helpful. Questions? Happy to help!