I was wondering if thier is a way to update/upgrade OPNSense by the way of a usb key?
In theory yes. You could sync the repository on the stick and afterwards configure pkg to use that as package source. However I would not recommend that.
Please note that I am not sure if kernel updates will work.
Why? I think it's a totally sensible and ligitimate use case to have a firewall without access to the interwebs. Why not make this happen?
I guess an internal mirror server is a more reasonable setup. Then you don't have to go to the firewall unmount plug off the USB drive and then rsync the updates and run to the firewall again to plug it in, mount it and install the updates. With a mirror server, you can automatically pull the updates and make them available to one or more firewalls.
Sure, an air gaped network make sense. But then you should still not run around with a flash key to every server to install patches.