How does that Docker image downloads Flarum? Are the files just "hard-coded" in the image?
Whether or not you install extensions, you need a strategy to update Flarum itself in case of any security fix. Whatever solution is used to update Flarum can probably be leveraged to install extensions as well.
If you're building your own Docker image, just install more packages in the build process so they are available offline. If you have a Packagist proxy or offline repo using Satis, include the extensions and their dependencies in the whitelist.
But as Luceos asks, are you really offline? Being in an intranet does not imply no internet access, you can probably whitelist what's needed without any additional software(?)