In example scenario below, the "XP" box can also be vista/win7-8-8.1 (maybe even 10), 32 or 64 bit. 
How to keep XP on minimally on network, but not internet, using network only to update time and push files via scp/sftp.
Both old XP and Server are kept safe by closing all ports on XP, and allow that XP computer to connect only to port 37 on a (rfc868 aka "rdate") time-server. The device providing TIME service on port37 should get its own time from internet/intranet (by ntp, etc).
(The time-server does not have run a server-os: it can be almost any linux device, or even a windows-pc.)

With all ports closed on XP, the time-server cannot infect XP. If XP is infected, such as by a usb-key, it cannot spread over
network to time-server (unless time-server has vulnerability known to virus. Turn off smb1 on time-server (if windows)!

On XP/7/8/8.1, rdatesvc.exe (= prdatesvc = PermaSoft Rdate service) safely keeps system time and date correct by periodically from
port 37 on a specified time SerVeR, such time.nist.gov one of the few public time servers in 2020 still answering on port 37
see https://tf.nist.gov/tf-cgi/servers.cgi  In our case since not on internet, we can get date/time from local intranet pc.

Old XP pc only able to see     RFC868 time SerVeR (rdate at port 37)
169.254.x.y (SerVeR)           Only port 37 needs be open on the 169.254.x.y fixed IP
                ------        +----------------+
               |      |       |       |F       |
               |  XP  |       |       |i       |
               |  all +-------+ 37    |r       +------>WLAN providing correct time and date
               | ports|       | is    |e       |       (usual networking, maybe even internt ;-)
               |closed|       | only  |W       |
               |      |       | port  |A       |
                ------        | open  |L       |
                              |       |L       |
         private un-routed    +----------------+
         (ethernet cable)
         from XP to Server