There is another method that might work. See Step # 3 in this article
This gives you a way to download all of the files your fixlets would need using the BESDownloadCacher.exe
Your would need to use the masthead file for the site you need to pull downloads for (in this case it would be EnterpriseSecurity.exfm.
Once you download all the files, they should be named their sha1 values.
You could then take them over to your airgapped BigFix server via USB sneaker net and drop them in the sha1 download directory.
Note: you’ll need to increase the size of this cache via a client setting which could be deployed via a fixlet see: http://www-01.ibm.com/support/docview.wss?uid=swg21505905
You’ll need to increase it to something large enough to accommodate the entirety of the downloads plus some so that files needed don’t fall off the cache during LRU churn. (lots of gigabytes needed here)
Then all the download files you need will be staged and ready to go.
Let me know if you try this and run into any problems so I can validate the the advice given here.
I realize this doesn’t address the need for not having to download everything from month to month. Just some ideas that might be incorporated into what you are trying to do.