Where does wordpress gets its core and plugin updates

Why would you even want n automatic update in such a setting? bit orgs rarely allow just random software being installed without testing it first.

In any case, this is unlikely to be achievable in a sane way unless you limit yourself only to plugins from the wordpress.org repository as any “pro” type of plugin and theme will require making more “holes” for its update server.

Unsupervised automated updates are always a bad idea, but to reduce general security to support them is just unthinkable from a security POV.