Revocation. OCSP and CRLs are pretty well irrelevant these days. They are not very effective for security. And if you can't reach the revocation authority, no problem, the browser happily ignores the network error and proceeds as if the certificates are unrevoked. So inability to make outbound connections for OCSP or CRLs shouldn't pose a problem.
Updates. The big one is downloading of updates (e.g., software updates, A/V updates). I think you may want to add a whitelist to your firewall of allowed outbound connections, so that machines can still get their security updates.
For Windows updates, I think you want to allow access to TCP ports 80 and 443 on the following domains:
See also Firewall rule to allow access to windows updates or other resources on a CDN?.