Robert – ‘Cached mode’ *plus* ‘offline mode’ delivers just security updates. ‘Cached mode’ *without* ‘offline mode’ delivers all classifications of updates.
‘Offline mode’ is only recommended for segregated networks that have zero direct access to the internet and zero access to a single computer that has access to the internet. For your situation it sounds like you probably should not be using offline mode and should just use cached mode (or potentially not even use cached mode at all, depending on your requirements).
More on WSUS and group policy with BatchPatch here:
https://batchpatch.com/batchpatch-integration-with-wsus-and-group-policy
More on cached mode and offline updates options/configurations here:
https://batchpatch.com/cached-mode-and-offline-updates