If you can build a second host similar to the restricted host, you can do the work there, and transfer it over. Perhaps a chroot'd environment would be sufficient.

It may be a fair assumption that you'll need to do it again in the future as your needs change. Having a "build" environment for managing that restricted configuration will come in handy.

It really comes down to the restrictions of that environment. If you really must trust that everything done to that host has been done without external access, a non-restricted build environment may not be an option. Not having access to an external yum repo will certainly help keep that build environment as similar as possible as well.