Windows Update from DMZ servers

Hello,

We have a few Windows servers in our DMZ. We are not willing to use the
internal WSUS server for security reasons.

Therefore, we will use the internet Microsoft Update servers. How should we
configure our DMZ servers and our external DMZ firewall ?

We have allowed http access from the DMZ servers to the MS servers

update.microsoft.com (207.46.253.157)
windowsupdate.com (207.46.18.94)
windowsupdate.microsoft.com (207.46.18.94)
windows.com (65.54.226.117)

But it still does not work. What else do we miss ?

Also, in case the IP's of the Microsoft servers change, we will need to
reconfigure our firewall settings. Is there a way to avoid that ?

Thanks in advance for any tip.