Installing the tool
To use the tool on an air-gapped machine, copy the binary across. There is no license check that phones home. Transfers can be audited because they are just file copies. Verify the checksum on the source side before you transfer it.
The tool does its core work without any network at all. Downloads happen once, when you install or update. The default assumption is that you may be offline. If a command ever needs the network, it says so plainly.
Nothing about an update requires the target to be online. Keep the previous binary until the new one proves itself. Updates on an offline machine are a deliberate, manual step.