When patching VM Templates, you cannot use a Distribution Server. This article explains the error this causes and how to resolve it.
Attempting to patch a VM Template fails, and returns "Error on machine <machinename>: Unable to deploy to an offline virtual machine using a distribution server due to network isolation"
Part of the process Protect uses to patch VM Templates is to disable the NIC of the virtual machine. When using a Distribution Server, this results in the VM being unable to download the necessary patch data from the Distribution Server, and the patch operation fails.
Use a Deployment Template with Console Push under Distribution Server. This will cause the patches to be copied over to the VM Template before patching.
Document on VM Patching process: How Patch Deployment Works For Hosted Virtual Machines And Templates