I don't know whether using MiKTeX or TeX Live at a bank is legal/regular/not contrary-to-contract. Checking this out (e.g. license-conditions at the side of MiKTeX/TeX Live, e.g. whatsoever conditions at the side of the bank/employer/client/contractor, etc) is up to you. I recommend not to perform illegal/irregular/contrary-to-contract actions. ;-)
Regarding the question whether using TeX is safe you might be interested in the discussion "Are there any dangerous commands in LaTeX?".
In any case, I would first check with the people responsible for computer security and have them confirm in a provable/legally binding manner that it is okay to attempt/to carry out intended installation steps/system changes.
Both with TeX Live and with MiKTeX you can easily create a local mirror of the entire package repository (e.g. on a removable medium like an USB-stick or a (micro)SD-card or an external USB-harddisk) and instead of having the installer downloading from the internet have it use the local mirror (on the removable medium) for installation.
(Local mirrors of package repositories can also be maintained, e.g., in samba-shares instead of using removable media. For installing things under Linux you usually need to mount the samba-share in question. With many Linux platforms you can use cifs for doing this.)
This feature is intended to offer the possibility of downloading only once for installing on several machines instead of repeating all the downloading with each single machine.
For creating the removable medium containing the local mirror you can probably use a machine not under the reigns of the bank.
Then, at the bank's machine where you want the TeX-distributon to be installed, launch the exe-file that makes up the installer from command-line and hereby via the appropriate command-line-options denote the removable medium as the location of the local mirror of the package repository.
If you can't insert/attach a removable medium (in)to the machine where you wish the TeX distribution to be installed, you probably can put both the installer and the folder containing the local mirror of the package repository into a zipped exe-file and after in whatsoever way transferring that to the bank's machine have that unzipped for obtaining both the local mirror and the installer on the bank's machine before running the installer.
In MiKTeX a local mirror of the entire package repository is called a "local package repository".
Both for obtaining a local package repository and for installing from a local package repository you can't use the "MiKTeX Basic Installer".
Instead you need to use the "MiKTeX Setup Utility".
You can obtain the "MiKTeX Setup Utility" at https://miktex.org/download: Just click the register "All downloads" and you will see it in the list.
Info on how to use the "MiKTeX Setup Utility" for obtaining a local package repository for MiKTeX is at https://miktex.org/howto/local-repository.
Info on how to use the "MiKTeX Setup Utility" for installing from a local package repository is at https://docs.miktex.org/manual/miktexsetup.html; see section "Options", "--local-package-repository=dir - Download into (install from) the specified directory".
Info on using a local package repository for deploying MiKTeX at your organization is at Rollout MiKTeX in your organization / https://miktex.org/howto/deploy-miktex. I think you won't need this. :-)
With TeX Live you can create a local mirror of the entire package repository, e.g., using rsync.
I don't know if there is a rsync-client for Windows or whether you can install rsync under Windows via Windows Subsystem for Linux (WSL). But you probably can boot some computer from a removable medium like USB-stick or (mico)SSD-card or external USB-harddrive or DVD, using a Linux live-system which boots from removable media and which brings along rsync. E.g., Knoppix is such a Linux live-system which can be installed on many kinds of removable media; release 9.1 is based on Debian bullseye with a few packages from Debian/unstable (sid).
Instructions on creating a local mirror of the entire package repository of TeX Live via rsync are at Downloading/mirroring the TeX Live repository / https://tug.org/texlive/acquire-mirror.html.
Instructions on how to have the TeX Live-Installer use the local mirror instead of downloading from the internet are in the The TeX Live Guide—2021 at https://www.tug.org/texlive/doc/texlive-en/texlive-en.html , "section 3.3.1 The -repository option".
Probably you can use the sfx-module of some zipping-tool for creating a self-extracting exe-file which extracts the installer and the local package repository, launches the installer using appropriate command-line-options so that the extracted package repository is used as local package repository. See, e.g., Is it possible to execute a file after extraction from a 7-Zip self-extracting archive (SFX) archive?.
Probably the bank can be convinced to maintain a repository for deployment in the organization and to deliver an sfx-exe-file which extracts and launches the installer with commandline-options for using the bank's deployment-repository.
I just read that you can use the MiKTeX-net-installer with command-line-options like -portable and -package-set=complete for downloading MiKTeX and then creating a portable MiKTeX-installation which contains everything.
Create the portable full MiKTeX-installation on a computer which does not belong the bank.
As the installation is portable, you can copy it by copying the folder that contains it. Copying in turn can be done by using a file-packer like 7-Zip or WinRar for packaging the folder into a self-extracting exe-archive.
This way there is no need for the self-extracting archive to execute whatsoever file after extracting.
You can obtain the "MiKTeX-net-installer" at https://miktex.org/download: Just click the register "All downloads" and you will see it in the list.
I think you can also create a portable full installation, using the Basic-Installer, obeying the instruction of renaming it to miktex-portable.exe as described at https://miktex.org/howto/portable-edition and additionally providing the command-line-option --package-set=complete described at https://docs.miktex.org/manual/setupwiz.html.
You can obtain the "Basic-Installer" at https://miktex.org/download: Just click the register "All downloads" and you will see it in the list.
