Install/provision for "unmanaged/self-managed" systems

Hi All, We are using Satellite 6.2 (with an upgrade to 6.6 coming but that is a different story) To handle a bunch of VM in a "traditional" Satellite way.
We have a new use case come up that I am not sure how to handle and would love to get some pointers. I am pretty much new to Satellite too.
We have a number of researchers who want to install RHEL on local to them physical hardware and use the Satellite system as their content source. We have enough subscriptions to cover them. We also have a custom repo that installs a package that ensures they meet the institution security policy and need to be there to allow network access.
How would I go about this? Here is what I think we need but I'm not sure how to go about making it happen.
1) have an iso available for download to flash to allow for initial booting.
2) have the kickstarted system use our satellite system for a content source using a dedicated ORG (let's say it is called RESEARCH)
3) make updated content available for them to upgrade or install new RH content.
4) lastly of course we want to remove the ability for them to get RH content once they leave the institution.
Being that these researchers are for the most part computer scientists these will be self manages systems - no puppet, no ansible etc. Satellite would only be used as a content source.

Thanks!