I don't know who told you that "connecting Splunk to the Internet is a bad idea". Depending on your setup, your Splunk environment might have many different components some of which must be somehow connected to internet (for example - because they need to pull events or update other data from the Internet).
Apart from that - in production environment the decision about whether some host should be allowed to connect to some other host(s) should generally done on a case by case basis following a more or less formal risk assesment.
So there is a general rule of thumb that unless needed (and unless it's "safe enough") hosts shouldn't be connected to anything. Not just the internet.
Having said that - the options you have available will differ depending on your architecture.
If you have an all-in-one installation, you can relatively safely open the outgoing traffic to Splunk update servers (you might want to disable telemetry if you're paranoid) and you can usually update the add-ons straight from Splunk's webui.
But it won't work in case of apps deployed via Deployment servers (in this case you have to upload a new version onto the DS, reload its config and let the forwarders pull the updated app). Or in clustered environment (both indexer clusters as well as search-head clusters). In those scenarios you have to manually download updated versions and put them in apropriate directories on the managing components (cluster manager and search-head deployer respectively).
If you have other types of data (like threat intel), well, it will depend on what kind of data it is and how it's configured. There is no general "fit for all" answer. Often just opening outgoing traffic to needed hosts will suffice.
