Running one-off cron jobs when WP_DISABLE_CRON is true: can I hit /wp-cron.php?

The WP_DISABLE_CRON constant only removes WP-Cron from loading on the page so it’s no longer triggered by site traffic.

You can absolutely hit the wp-cron.php file directly to trigger it. I use https://cron-job.org to ping my private sites at https://dev.example.com/wp-cron.php?doing_wp_cron for example.

This is actually recommended in the WordPress handbook: https://developer.wordpress.org/plugins/cron/hooking-wp-cron-into-the-system-task-scheduler/

Editing to add: if you’re concerned about triggering any other hooks associated with WP-Cron that maybe the site owner wants to avoid, you can also use cron-job.org (or a server CRON) to ping a page within your plugin to only run your update function without triggering WP-Cron at all.