Maybe it could help,
I do like that my updates :
Periodicly I powered a blank computer with no update on the network, then affect him the patch source to the server near of him. It take a while to download everything so i plan it on night or on week end to minimize the bandwidth overuse. Then I've got a full folder with all my updates ready to be downloaded. I've notice the fact following, if you plan multiple machines on the same Lan Share, sometimes the Kserver told to the managed workstation to download the patch twice because server don't have the request file, so I do like I explain, just one machine by OS for start then both of them after...
If you install new machine, why don't you add update in your installation media ? it's should be better to do like that...