SCCM Software updates management in SCCM hirarchy

Hi,

We have 1 central site and 2 primary child sites. When we deploy updates from the central site to clients in the child sites everything is working fine.

All child sites have a SUP role that connected to the central site (downstream). The central site use proxy to connect to the internet.

My questions are:

Is it possible to manage SU from the child site (create update list and downloading SU for packages)?

if so, do we need to connect the child sites to the internet?

Can we manage SU from a remote console?

Kobi