Updating applications (e.g., Zotero) in template VMs which are not linked to the package manager

[enmus]

He probably means over qrexec.
Without connecting template to internet, you can update only software for which you have correspondent software repository in your repo file(s).
Otherwise, @tzwcfq’s tip is a way to go.

You might want to read

Can't add gpg keys to template

As a noob I’ll try to add my two cents too. To get online, we are doing it over TCP/IP protocol - via networking. Since this is not secure by any means, Qubes devs disabled networking for dom0 and templates and invented new, secure protocol - qrexec primarily for templates (and dom0). Think of it as a proxy, which it actually is. So you are getting stuff from online and not being online out of the box. Great, isn’t it? Well, there’s a catch. Access to online stuff out of the box is limited on…