You can use the Rublon for Windows Logon & RDP connector even if the machine on which the connector is to be installed cannot have direct access to the Internet. This is possible using a proxy server (e.g., Squid). A local proxy server directs the machine's traffic to itself. Then, the proxy server connects to the Rublon API.
Rublon 2FA for Windows Logon and RDP - Documentation