We do not provide a default way to receive updates in a private manner. However, one can arrange private methods of doing so. Create an ubuntu mirror via an out-of-bound connection and point your machines there, thus not exposing update traffic to a monitored connection.
After establishing an out-of-bound mirror, you may even wish to publish it over SSL. Which is totally valid, and supported by all Ubuntu installations that have apt-transport-https package installed.
We do not provide a default way to receive updates in a private manner. However, one can arrange private methods of doing so. Create an ubuntu mirror via an out-of-bound connection and point your machines there, thus not exposing update traffic to a monitored connection.
After establishing an out-of-bound mirror, you may even wish to publish it over SSL. Which is totally valid, and supported by all Ubuntu installations that have apt-transport-https package installed.