Subscription-manager using local repo

HI
We have redhat linux 5,6,7 servers. I am moving them all to subscription manager, and am almost done.

Our network/firewall group is complaining that these machine, of which quite a few are phi/restricted network machines, now require opening to port 443 to allow the Subscription-manager yum connections using 443/cert access

Our firewalls do not allow rules based upon wildcards, like *.redhat.com, etc.

So, I must be missing something, but somehow there MUST be a way, like satellite used to do, to store repositories locally, and use a canned package to point to those repositories rather than the redhat ones, so these machines can make local connections.