In some environments, the vCSA appliance may not have any connectivity to the Internet.
This is certainly a good practice to ensure your environment is secure. In that case you can either deploy a proxy server for it to connect to and perform updates online via the Administrative GUI https://<vCSA URL>:5480 (available after vCSA 6.0 Update 1) or download the patch iso and perform it manually as below.

In this example I am patching to vCSA 6.0 Update 2 and assuming you have deployed the vCSA with an external Platform Services Controller, rather than embedded. However the process is the same and instead of patching two appliances you just patch the one appliance that you have. It's the same process for both.

Patch the Platform Services Controller (PSC) first.
  1. Navigate to VMWare Patch Download Site HERE and download the FP (Full Patch) iso for the version you are patching to
    Note: The Updaterepo zip from the normal vCenter Download page is not the same thing.

  2. Mount the iso to the PSC vm appliance, ssh to the PSC and run:

software-packages install --iso --acceptEulas

Once the "Packages upgraded successfully" message appears, reboot it by running:

shutdown reboot -r "Updated to vCSA 6.0U2"
Note:: Remember that during the patching you will lose connectivity to vCenter so take note of the ESXi Host the vCenter appliances are attached to first.

Once the PSC comes up, you can then patch the vCenter itself as above.