Update software on VM with Internal IP

[Tricia_103_Lyon]

What is the best practices way to load & update software on a Debian VM that has only an internal IP?
(Can't use get-apt since no external IP)