Good question!
The answer probably depends on what sort of information is stored on the intranet and whether the employees and contractors who have access to the intranet are competent and can be trusted.
Is it possible that an employee or contractor could connect a compromised laptop to the internal network where malware on the laptop could compromise the intranet?
How secure is the internal network? For example, do employees and contractors have remote access via a VPN or similar? Is temporary VPN access for contractors religiously revoked when their access is no longer required?
I'd be inclined to back up the website and apply Joomla and third party extension updates on a regular basis, in the same way as if the website were on the Internet.
The effort required is minimal and the risk of complications when applying Joomla and third party updates is low (especially if you are using well supported third party extensions from trusted developers).
In the unlikely event that an update breaks the website, it is fairly easy to restore a Joomla website from a recent backup using Akeeba Kickstart or similar.