It has long been best practice to firewall databases from the internet. Both SSIS and SqlCLR are proscribed by most corporate governance practices from internet connections altogether, proxies block outbound traffic altogether. Ideally WSUS servers handle service packs and update installations in order to protect the database. Sacrificial app servers are much better suited handling httpwebrequests.