[...] And to get those libraries, you're exposing the offline machine to website downloads, or even worse going online with it to get the backported libraries.
Not necessarily. One solution is using Synaptic offline, for example:
https://bitcointalk.org/index.php?topic=777625.0