What is wrong with the solution of buying a normal license, instead of a CHR license? To me that makes the most sense for an “airgapped” router.
All of this is well documented by MikroTik already: link
If the “deadline-at” date is reached without successfully contacting the account server, the router will consider that the license has expired and will disallow further software updates. However, the router will continue to work with the same license tier as before.
After successful communication with the license server, the dates will be updated.
So the router will continue to function; it just won’t let you update the RouterOS version.
If you absolutely insist on using CHR instead of regular RouterOS licensing, rather than prepping the VM on one machine and then cloning it onto its final destination (and having to jump through all of the hoops to work around the system ID changes and everything), what I would do is install it on its permanent home first, hook it up to the internet temporarily, install the license, then disconnect it. The problem you will still have moving forward, though, is that every time you need to upgrade RouterOS, you will need to find a way to hook it up to the internet first in order to do it, which still makes the non-CHR license superior for this particular application, in my opinion.