The safest and sanest approach for all is to keep the network settings and burn a small copy of CPAN to a CD via CPAN::Mini, and transfer that CD by sneakernet to the machine.

Otherwise, the cpan shell tries to use http and ftp, which use port 80 resp. port 20 and 21 outgoing. But I wouldn't risk reconfiguring (and thus malconfiguring) the firewall just for CPAN.