I think the bigger issue would be keeping these machines disconnected from the internet. No need for patches if it's an isolated system running DOS.