You could use a persistent live USB instead of a full installation on USB.  But you need to permanently install the software unless you want to re-install it every time.

Whether an updated install is more secure than an un-updated install is difficult to answer.

I would just disable the network in /etc/network/interfaces by setting some dummy value.  I think that wouldn't keep it from giving the annoying waiting for network message on boot?